how to edit product single quote in sql server c#

Prashant Malav

10y1.8kVisual Basic .NET

Hello..

i have one page(product.aspx)

1. sku textbox

2. title textbox

3.description textbox

insert single quote in sql server table

insert into table(sku,title,description) 
values ('sku-girl''s','cookie''s','description''s')

but product.aspx page update button click and save this page ...
but sku,title,description insert ('') why ... can without ('') save page.

how to solve ...

5 Replies

Know the answer? Post it — somebody with the same question will find it here.

Manas Mohapatra10y ago
Accepted answer
Hi Prashant,

I suspect that you are using below to insert single in database:

string sql= "insert into table(sku,title,description) " +
"values ('" + skuTextBox.Text.Replace("'", "''") + "', '" + titleTextBox.Text.Replace("'", "''") + "', '" + descriptionTextBox.Text.Replace("'", "''") + "')";

Technically it is correct to accomplish it. But it is always recommended to use Parameterized query like below:

string sql= "insert into gtable (sku,title,description) values (@sku,@title,@description)";
SqlCommand cmd = new SqlCommand (sql, con);
cmd.Parameters.AddWithValue("@sku",skuTextBox.Text);
cmd.Parameters.AddWithValue("@title",titleTextBox.Text);
cmd.Parameters.AddWithValue("@description",descriptionTextBox.Text);
con.Open();
Manas Mohapatra10y ago
Prashant, if it helps you, please accept the answer.
Prashant Malav10y ago
Dear manas mohapatra

Thankx for your solution ...solve my problem
Prashant Malav10y ago
Dear Raja,

insert time not problem but i need update my page .
update time are double single quote insert then update my page....
Raja T10y ago
Hello Prashant, Please confirm how to insert query i mean hard code or text box value like below?
insert into table(sku,title,description) values ('sku-girl''s','cookie''s','description''s')
or
insert into table(sku,title,description) values ('"+sku.Text+"','"+title .Text+"','"+description.Text+"')
and also confirm which time are facing error update or insert?