how can I use handle Verbatim String Literals?

Question

I have below oracleCommand and like to change below but having error...doesn't except my +item+ and + txtSrcUserID.Text.ToUpper() + . in the oracleCommand. How can I add them to my command?

Original

foreach (string Items in listBox39.Items)
                    {
                        using (OracleCommand crtCommand = new OracleCommand(@"SELECT  REGEXP_REPLACE ( REPLACE ( dbms_metadata.get_ddl ('PROCEDURE', 'HELL_'), '""USER1"".'),'^\s+', NULL, 1, 0, 'm') FROM dual", conn1))
                        {

                        }
                    }

I like to make similar to below

foreach (string Items in listBox39.Items)
                        {
                            using (OracleCommand crtCommand = new OracleCommand(@"SELECT  REGEXP_REPLACE ( REPLACE ( dbms_metadata.get_ddl ('PROCEDURE', '+ Items +'), '"" + txtSrcUserID.Text.ToUpper() + "".'),'^\s+', NULL, 1, 0, 'm') FROM dual", conn1))
                            {

                            }
                        }

You're trying to have a SQL injection vulnerability. Use parameters. — SLaks, Aug 12 '13 at 03:43

score 0 · Accepted Answer · edited May 23 '17 at 12:05

0

foreach (string Items in listBox39.Items)
{
    using (OracleCommand crtCommand = new OracleCommand(@"SELECT  REGEXP_REPLACE ( REPLACE ( dbms_metadata.get_ddl ('PROCEDURE', '" + Items + @"'), '""" + txtSrcUserID.Text.ToUpper() + @""".'),'^\s+', NULL, 1, 0, 'm') FROM dual", conn1))
    {

    }
}

But as @SLaks suggested in his comment, better to use parameters:

OracleCommand.Parameters

OracleCommand SQL Parameters Binding

edited May 23 '17 at 12:05

Community

1
1

answered Aug 12 '13 at 04:14

Adel Khayata

2,717
10
28
46

not works:( I have ""USER1"" but your answer has only one quotation " + txtSrcUserID.Text.ToUpper() + " – user2661591 Aug 12 '13 at 05:01
I have updated the answer, this depends that your txtSrcUserID.Text contents is only: USER1, I still encourage you to use the links in my answer to use parameters. – Adel Khayata Aug 12 '13 at 05:06

how can I use handle Verbatim String Literals?

1 Answers1