Question

I am executing a stored procedure on a SQL server using a SqlCommand class from C#. Currently I just build an execution string that parses in the parameter values to the stored procedure then executes the string on the server. The problem is when I have quotes the string does not get passed properly

Is it possible to use SqlParameter objects to pass in the parameters without worrying about escaping out of quotes?

Answer 1

Yes, that is the preferred way of sending parameters.

Example:

using (SqlCommand cmd = new SqlCommand("SomeProcedure", connection) {
  cmd.Parameters.Add("@Id", SqlDbType.Int).Value = 42;
  cmd.Parameters.Add("@Text", SqlDbType.Varchar, 50).Value = "A string value";
  cmd.ExecuteNonQuery();
}