Question

I have the following SQL insert statement.

insert into [dbo].[Lookup] (XMLField)
        select          
            '<root>' +          
            '<SQL>' + SQLQueryToEscape + '</SQL>' +         
            '</root>' as CustomData         
        from dbo.CustomView 

My dilemma is that the SQLQueryToEscape has characters in it that aren’t XML safe. I need to escape the string. What is the best way to do this in tSQL?

Answer 1

Use FOR XML to generate proper XML instead of concatenating strings!

insert into [dbo].[Lookup] (XMLField)
select SQLQueryToEscape
from dbo.CustomView 
for xml path ('SQL'), root('root')