CODEWITHSUNDEEP
c#quotes
Petr
Petr

Reputation: 1219

Double double quotes in the string

In c#: I need to create oracle query string like this:

string orQr = @"
    SELECT ""Date"", ""Key""
    FROM TBL
";

I need to do it dynamicly. But there is a problem with escaping double-double quotes.

How to do that? This is a little mad ;-) and doesn't work:

string quotes = @"""""";
string subSlct = quotes + "Date" + quotes + ", " + quotes + "Key" + quotes;
string orQrB = @"
    SELECT " + subSlct + @"
    FROM TBL
";

(the result is: SELECT \"\"Date\"\", \"\"Key\"\"\ FROM TBL )

Upvotes: 1

Views: 1794

Answers (4)

dcastro
dcastro

Reputation: 68660

Your quotes variable is adding two double quotes, instead of one. Change this:

string quotes = @"""""";

to this:

string quotes = @"""";

Also:

  1. There's nothing wrong with string.Format("SELECT \"{0}\", \"{1}\" FROM TBL", a, b);

  2. Your code is susceptible to SQL injection.

    In general, you'd want to use parameterized queries, but since these don't allow parameterized column names, you'll want to at the very least sanitize the input yourself and check for illegal characters (e.g., ;, --).

Upvotes: 4

Robert S.
Robert S.

Reputation: 2042

You can just use normal escaping like: string quotes = "\"\"";

Upvotes: 1

Liviu Mandras
Liviu Mandras

Reputation: 6617

Don't construct your query by string concatenation. You open yourself to SQL injection attacks. Use parameterized queries and you will also be able to include the quotes more easily.

Upvotes: 2

kidshaw
kidshaw

Reputation: 3451

Does this work:

string quotes = "\"\"";

Upvotes: 2

Related Questions