Home/ Questions/Q 645925
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T21:33:22+00:00

I use an API that expects a SQL string. I take a user input,

  • 0

I use an API that expects a SQL string. I take a user input, escape it and pass it along to the API. The user input is quite simple. It asks for column values. Like so:

string name = userInput.Value;

Then I construct a SQL query:

string sql = string.Format("SELECT * FROM SOME_TABLE WHERE Name = '{0}'",
                           name.replace("'", "''"));

Is this safe enough? If it isn’t, is there a simple library function that make column values safe:

string sql = string.Format("SELECT * FROM SOME_TABLE WHERE Name = '{0}'",
                           SqlSafeColumnValue(name));

The API uses SQLServer as the database.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Since using SqlParameter is not an option, just replace ‘ with ” (that’s two single quotes, not one double quote) in the string literals. That’s it.

    To would-be downvoters: re-read the first line of the question. “Use parameters” was my gut reaction also.

    EDIT: yes, I know about SQL injection attacks. If you think this quoting is vulnerable to those, please provide a working counterexample. I think it’s not.

    • 0