Question

I currently use MySql, but would prefer an ODBC solution to make it future proof.

How do I sanitize user input before passing it to an ODBC database ?

And, while I’m at it, I wrap my string in double quotes, e.g. “INSERT INTO VALUES(description) “”` – but what if the text itself contains a double quote?

Answer 1

Try using a parametrized SQL sentence

like this.

INSERT INTO MyTable (Field1,Field2) VALUES (:Param1,:Param2)

check this article from embarcadero for more info about how use parameters Using Parameters in Queries.