遇到包含撇号的名称（例如O'Conner）时执行查询时出错

Question

My database program has a statement like:

variable = "SELECT * from Staff where StaffName = '" & cStaffName & "'"

This works fine until I have a member of staff with ' (apostrophe) in there name as it ends the start apostrophe.

SELECT * from Staff where StaffName = 'O'Conner'

Is there a way around this without replacing the apostrophe in her name?

Answer 1

You just need to use a parameterized query.

Using con = new SqlConnection(....)
Using cmd = new SqlCommand("SELECT * from Staff where StaffName = @name", con)
   con.Open
   cmd.Parameters.Add("@name", SqlDbType.NVarChar).Value = cStaffName
   Using reader = cmd.ExecuteReader
     .....
   End Using
End Using
End Using

In this scenario you add a parameter to the SqlCommand parameters collection. The command text has no more a string concatenation but contains a parameter placeholder (@name). The parameter itself contains the value you want to pass to your query. In this way there is no problem with quotes embedded in the value.
You also get the extra benefit to avoid any kind of Sql Injection problem with the user input

Answer 2

variable = "SELECT * from Staff where StaffName = '" & Replace(cStaffName, "'", "\'") & "'"