Question

I am trying to run this SQL from ASP.NET 2005 but am getting an invalid SQL error because it has a weird character ” in it.

In my code I am trying to replace ” with " but it is not doing it as the special character in the replace command is changing to ".

Query:

insert into userquery(description)
  values ('In fact, Topeka Google Mayor Bill Bunten expressed it best: “Don’t be fooled. Even Google recognizes that all roads lead to Kansas, not just yellow brick ones.”')

If I copy and execute this in mysql it is working good.

How can I solve this problem?

Answer 1

You’re building your query wrong. You didn’t say c# or vb.net on the client, but either way your sql string should look more like this:

string query = "insert into userquery(description) values (@description)";

And then you set your description value like this:

using (var cn = new MySqlConnection("... your connection string here..."))
using (var cmd = new MySqlCommand(query, cn))
{
   /* THIS IS THE IMPORTANT PART */
   cmd.Parameters.Add("@description", SqlDbType.VarChar).Value = MyDescriptionVariable;
   /*****************************/

   cn.Open();
   cmd.ExecuteNonQuery();
}

And the vb version:

 Using cn As New MySqlConnection("... your connection string here..."), _
       cmd As New MySqlCommand(query, cn)

   ''# THIS IS THE IMPORTANT PART
   cmd.Parameters.Add("@description", SqlDbType.VarChar).Value = MyDescriptionVariable
   ''############################

   cn.Open()
   cmd.ExecuteNonQuery()
End Using

This will make sure your parameter is properly escaped, no matter what odd characters you have.