SQL Escape ' '

Question

I am trying to run a query in SQL 2008 by doing:

@query varchar(max)

SET @query = \'SELECT * FROM Table WHERE [Name] = \' \'Karl\' \' \'

EXEC(@query)
         


        

Answer 1

This works:

create table #demo([Name] varchar(max))
insert into #demo([Name]) values('''Karl''')
insert into #demo([Name]) values('Karl')
declare @query varchar(max)
set @query = 'SELECT * FROM #demo WHERE [Name] = ''''''Karl'''''''
EXEC(@query)

Output:

'Karl'

But if 'Karl' is variable text, it's highly recommended to use something like this instead:

declare @query nvarchar(max)
declare @param varchar(max)
set @param = N'''Karl'''
set @query = N'SELECT * FROM #demo WHERE [Name] = @param'
exec sp_executesql @query, N'@param varchar(max)', @param