0

Lets take a string as userinput.

WHEN :

string sUserInput = "Jonson"

THEN :

SQL Like Operator :

"SELECT * FROM Table_User WHERE UeserName LIKE ('%" + sUserInput + "%')

means "SELECT * FROM Table_User WHERE UeserName LIKE ('%Jonson%')

WHEN :

string sUserInput = " 'N/M' Jonson" ;

Then In LIKE part sql gets error, because It becomes ('%'N/M' Jonson%').

It gets error because it get '' (single quotation) within ''(single quotation). How can I solve it?

Dharman
  • 30,962
  • 25
  • 85
  • 135
rete tertre
  • 1
  • 2
  • 1
    This is what bind variables are for. Not only are you less vulnerable to SQL injection but all of this stuff is done for you. What language are you using? The less complicated answer is to escape the single quote, which means adding 2 instead of 1. – Ben Apr 27 '15 at 03:58
  • No, I am using C# @Ben – rete tertre Apr 27 '15 at 04:00
  • For what you should be doing so you're not vulnerable see http://stackoverflow.com/q/6547986/458741, http://stackoverflow.com/q/9162862/458741, http://stackoverflow.com/q/14376473/458741 and http://stackoverflow.com/q/5468425/458741 – Ben Apr 27 '15 at 04:05
  • Just I need how to get single quotation within single quotation in a query? – rete tertre Apr 27 '15 at 04:27
  • I know, the duplicate question tells you how, I'd recommend doing it properly though, hence the additional links. – Ben Apr 27 '15 at 04:28

0 Answers0