在C＃中查找特定的单引号并将其替换为双引号

Question

I've a problem where I want to replace some specific single quotes with double quotes inside a SQL string but not all singles quotes in that string.

EXEC procedureName 'param'eter1', 'parameter2'

In above example I just want to replace the singles quotes inside the 'param'eter1' but the singles quotes in start and end of the parameter to remain same.

Using below command replace all singles quotes in the string and it looks like this ''param''eter1'' which is not correct.

sometext.Replace("'", "''")

I want it to look like this:

EXEC procedureName 'param''eter1', 'parameter2'

Also please note that I am already aware that using SqlParameter is a better solution to handle the single quotes in SQL parameters but due to the restrictions in the project environment I am unable to implement that.

Update:

Changing the individual parameters before using them to construct the full statement is not an option for me as I don't have access to that code. My project works like a data layer where it received SQL strings from other applications to process.

Answer 1

This is a very bad idea. The SQL syntax requires you to escape single quotes in literals exactly because it can otherwise not tell whether the single quote is meant to represent a single quote or meant to terminate the string literal.

Consider the following example:

EXEC procedureName 'param ', ' eter1', 'parameter2'

How would you know whether this is meant to have three parameters for the procedure call or only two? And even if you knew that this specific procedure takes two parameters, you couldn't decide whether the middle part belongs to the first or second parameter.

If the system constructs sql statements from user input without dealing with single quotes before the full statement is constructed, this can be used very easily to attack the system via an sql injection .

Answer 2

you can do like this

var aStringBuilder = new StringBuilder(theString);
aStringBuilder.Remove(3, 2); // just find a position of single quotes 
aStringBuilder.Insert(3, "/""); // replace that position with " quotes using loop
theString = aStringBuilder.ToString();