Ado .net syntex error near ' 1

[shifar]

I have a problem when I try to save a textbox.text in to SQL sever with ADO .net I cannot pass ;' charectors say
eg. low'
I get the error saying syntex error near low'.

I use the sql Insert commnad to insert the data.

Do I need to use another method. I also upgraded to MSDE 8 but still problem persists.
any ideas.
thanks

 

[SHelton]

In SQL, a single quote is the delimeter for a string. To ensure that a single quote is parsed correctly, make it two single quotes, e.g:

Surname = "O'Connell"

would fail.

Surname = "O''Connell"

would work and be stored as O'Connell.

 

[rosenk]

If you're using text entered from a text box, you generally want to use parameters for passing the data along to SQL Server. Otherwise you're opening yourself up for trouble, particularly if your users might be malicious.

Here's an example (assuming [tt]conn[/tt] is your already opened SqlConnection):

Dim cmd As New SqlCommand("INSERT INTO MyTable VALUES (@col)", conn)

cmd.Parameters.Add(New SqlParameter("@col", TextBox1.Text))
cmd.ExecuteNonQuery

 

[shifar]

Thanks rosenk:

It works many thanks..........