Storing special character(s) in SQL Server through ASP.NET

Question

I've a TextBox in which i enters Name like Jame's and then i click on submit button. But it throws error Incorrect syntax near 's'. Unclosed quotation mark before the character string '

Jignesh Trivedi · Answer

Hi, you have two options 1) replace single quote with two single quote SQLCommand cmd = new SQLCommand("insert into tableName values ('"+textbox1.Text.Replace(''','''')+"')",conectionstring); 2) Use Parametrerized query SQLCommand cmd = new SQLCommand("insert into tableName values (@name)",conectionstring); cmd.Parameters.AddWithValue("name", textbox1.Text); hope this will help you.

Patel Soniya · Answer

very usefull thank u

Shreeharsha BR · Answer

It will not working. Is any other way? or is that requires any additions feature like name space or other?

Niradhip Chakraborty · Answer

By default it wont take '. U need to replace it by ' ' while storing into database but dont worry it will store the ' only. Use the following code: Say u want customer name should accept '. like peter's.So the time of saving use the following convertion in your pagebehind class(.aspx). txtCustomerName.Text.Replace(" ' ", " ' ' ").Trim()

Manoj Bisht · Answer

Thnx Rakrus for your reply. But still it's not working properly. Here i'm giving my code string name=Server.HtmlEncode(txtName.Text); string strsql="Update Rough Set Name='"+name.ToString()+"' Where Active=1";

Rakrus · Answer

string strTxtVal=Server.HtmlEncode(TextBox1.Text); use the above encoded value to insert into database. While retrieving the save value from database you need to decode it and set it to textbox. TextBox1.Text=Server.HtmlDecode(encoded textbox value (i.e value from database)) I think you got it.

Manoj Bisht · Answer

Plz explain it........

Rakrus · Answer

hi you can solve this problem by using html encoding and decoding