Home/ Questions/Q 6556987
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T13:01:00+00:00

I follow the syntax of INSERT INTO Table1 VALUES (value1, value2, value3…) This has

  • 0

I follow the syntax of

INSERT INTO Table1
VALUES (value1, value2, value3…)

This has worked fine so far. But now I have some values that contain normal English text like “I’m going home”. The ‘ character ruins the SQL command in C#. I have written the following:

command.CommandText = "INSERT INTO Bio VALUES ('" + name + "','"I'm going home" + "');

evaluates to

INSERT INTO Bio VALUES ('Peter','I'm going home')

which obviously will not work. How do I make sure special character will not ruin the SQL statements?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Use SqlParameter for heaven’s sake. Otherwise your program will be vulnerable to SQL Injection. It will also solve your problem with the special characters.

    • 0