I have an international company that has recently been added, which is named ‘BLA ‘BLAHBLAH’ Ltd. (The double quotes are part of the name. )
Whenever a user tries to search for this company, by entering ‘Blah, or something to that affect, the search fails with a syntax error in SQL server.
How can I escape this so the search will not fail?
Sample SQL:
SELECT c.companyID, c.companyName, c.dateAdded, count(cm.maxID) as NumDirect FROM RussoundGeneral.dbo.Company c LEFT JOIN RussoundGeneral.dbo.CompanyMax cm ON (cm.companyId = c.companyId and cm.maxID is not null) WHERE CONTAINS ( companyName, ''BLAH*' ) GROUP BY c.companyID, c.companyName, c.dateAdded ORDER BY c.companyName ASC
Unfortunately, double-quotes have special meaning inside FTI, so even if you parameterize it, the FTI engine treats it as a phrase delimiter. I am not sure there is an easy way to include double-quotes in an FTI search. Brackets are also a special character, but can be encased in quotes to treat as a query term – but not AFAIK double-quotes.
Update
A bit of searching suggests that doubling the quote to ” may fix it – worth a try. Personally, I’d do this inside the DB, since this is a TSQL implementation detail.
Likewise, ‘ needs to be doubled to ” before passing to FTI (completely separate to TSQL escaping),