vb.net escape reserved keywords in sql statement

Question

I\'m trying to execute an sql statement in vb.net to an Access database, I am escaping the reserverd word using square brackets []. This has worked in all my SELECT

Answer 1

You're not enclosing your values in quotation marks. Try this:

datalayer.getDataTable(String.Format(
 "INSERT INTO users (username, password, [level]) VALUES ('{0}', '{1}', '{2}')", 
 username, password, level))

However, as Andrew says, you should really use parameters. In Access SQL (David W Fenton will come along shortly and say it's "Jet" SQL) you have to use positional parameters. Your statement would then look like this:

INSERT INTO users (username, password, [level]) VALUES (?, ?, ?)

You'd need to create OleDbParameter objects with the correct values, and an OleDbCommand with the text above to execute in order to do your insert.

Answer 2

Always use parameters. What you're doing is very dangerous and leaves the door open to SQL injection.

Then you won't have to worry about escaping the values you're inserting into the database.