0

When running the below query getting the above error,

String sql = "((NAME= '" + sReceipts[0] + "' ) OR (SECTION IN ('RECEIPT', 'PROJECT') AND NAME IS NULL))";

sReceipts[0] value is 'Tom's' (with an APOSTROPHE) gives the error

But if sReceipts[0] = 'Ann' no error occur.

Tried to solve with String.Format but I couldn't. What is the best approach please?

Dmitry Bychenko
  • 180,369
  • 20
  • 160
  • 215
Keshani
  • 3
  • 1

2 Answers2

4

You should use parameterised queries such as the below:

OracleCommand oraCommand = new OracleCommand("SELECT YourColumn FROM 
YourTable WHERE ((NAME= :receiptName ) OR (SECTION IN ('RECEIPT', 'PROJECT') AND NAME IS NULL))", db);
oraCommand.Parameters.Add(new OracleParameter("recieptName", sReceipts[0]));

See MSDN OracleCommand.Parameters Property if you are using the Microsoft class and OracleParameterCollection for the equivalent Oracle parameter collection.

SpruceMoose
  • 9,737
  • 4
  • 39
  • 53
-2

I would wrap sReceipts[0] in a regular expression that replaces the apostrophe with two apostrophes.

Escaping single quote

Oracle regular expressions

Mark Wagoner
  • 1,729
  • 1
  • 13
  • 20