Single quote handling in a SQL string

Question

I have an application where the values in the text field are sent to the database.

For example I have a form with one field (text box). When I press Ok button then t

Answer 1

Hope this will help you ...

public static string DoQuotes(string sql)
    {
        if (sql == null)
            return "";
        else
            return sql.Replace("'", "''");
    }

Answer 2

Use .Replace("'","''''")

For example

string name = txtName.Text.Replace("'","''''");

Now name can be passed as a parameter in stored procedure etc.

Answer 3

Don't ever build SQL statements like that, it's very unsafe (read this). Use parameters, i.e:

var command = new SqlCommand("select * from person where firstname = @firstname");
SqlParameter param  = new SqlParameter();
param.ParameterName = "@firstname";
param.Value         = "testing12'3";
command.Parameters.Add(param);