Question

I have a textbox in my WinForm.

The user types text (anything that their keyboard allows). When they click save, sometimes an error message appears with

Syntax Error (missing operator) in query expression

I know that certain characters like ‘ are breaking my SQL query

I have a few questions

1. Is there anything I can do so that my Query doesn’t break and allow users to type whatever they want?
2. If there isnt a way to do #1, how can I scan the text and remove all characters that would break my Query?

Answer 1

try passing the textbox value to the query by using parameters. This will also prevent SQL-injection attacks.

should look something like this:

SqlCommand cmd = new SqlCommand();
cmd.Connection = conn;
cmd.CommandText = "SELECT * from TableName WHERE FieldA = @FieldValue";
cmd.CommandType = CommandType.Text;

//Define SqlParameter object and assign value to the parameter
cmd.Parameters.Add("@FieldValue", SqlDbType.VarChar, 50);
cmd.Parameters["@FieldValue"].Value = TextBox.Value;