Question

I have a function that gets called with a parameter called “name” now it works fine.. until i do a search with a ‘ in it.. so I am sending this as the name

Plastic & Foam 3'X5' XLT

When i send that it returns empty in the website (no errors) but if i send jusr Plastic & Foam it works fine, it comes back ok. Now in the sql part I get this when i send the query through management studio like this

exec sp_productSearch 'Plastic & Foam 3''X5'' XLT'

SELECT Name FROM PProducts WHERE NAME LIKE '%Plastic & Foam 3'X5' XLT'
Msg 102, Level 15, State 1, Line 1
Incorrect syntax near 'X5'.

In C# i am sending the text list this

Server.HtmlEncode(txtproductname.Text.Trim().Replace("'", "''"))

Any Ideas what I may be doing wrong?

PS: The stored procedure is simple, is something like this

Select Name from PProducts Where NAME LIKE '%' + @NAME  + '%' ;   

Thank you.

Answer 1

It looks like you already have a parameter called @NAME

So your stored procedure just needs to do

SELECT Name
FROM   PProducts
WHERE  NAME LIKE '%' + @NAME + '%' 

Or, better, so it returns correct results in the event that any of your product names contain pattern characters such as % don’t use LIKE at all and use

SELECT Name
FROM   PProducts
WHERE  CHARINDEX(@NAME,NAME) > 0

Or, even better, use Full Text Search

I presume that you are building the query string inside the stored procedure and then executing it. This is not necessary based upon what you have posted so far and is a SQL injection risk.

Also don’t manually escape the txtproductname.Text value. Pass it in “as is” using parameters.