Question

I have created web service in c#.In that admin panel when admin edit file name with escape sequence character it gives error. i want to add ‘s in the audio file name.But when i update that filename it gives an error.please suggest me the code.here is my current code:
for ex:i want file name like: stafford’s.mp3

                  protected void dbUpdate(int Id, string newfileName,string newfilePath,string newfileExt,string newfileType )
{
    string filep;
    if (newfileType == "Image")
    {
        filep = newfilePath + newfileType + "/" + newfileName.Replace(" ", string.Empty) + newfileExt;
    }
    else 
    {

        filep = newfilePath + newfileType + "/" + newfileName.Replace(" ", string.Empty) + newfileExt;
    }

    String getSQL1 = "UPDATE tbluploadedfilesdetail set FileName='" + newfileName + "' FilePath= '" + filep + "' where ID=" + Id + ";";
    MySqlConnection objMyCon1 = new MySqlConnection(connection);
    objMyCon1.Open();
    MySqlCommand cmd2 = new MySqlCommand(getSQL1, objMyCon1);
    cmd2.ExecuteNonQuery();
    objMyCon1.Close();

Answer 1

if you replace single quote with double single quote, it will solve you problem.

... set FileName='" + newfileName.Replace("'", "''") + "' ...

You should be using SqlParameters instead of substituting values directly into your sql. So look up SqlParameters.