CODEWITHSUNDEEP
c#sql-server
amin
amin

Reputation: 59

Random special characters in insert

I have the following Code in C# ( Sql server (LocalDB)\v11.0) If Definition property has no special character , the Insert executed. but some times it has an unknown special character in it , and i recive the Error.

 for()
  {
  if(){
  DB.Docommand("INSERT INTO Test5(P_Def) VALUES('"+ pro.Definition + "')");
      }
  }

in database the data type is nvarchar(Max) but i receive the following error:

incorrect syntax near .....

I want to insert my property with special characters. What can id do? Thanks

Upvotes: 1

Views: 108

Answers (1)

Sergey Kalinichenko
Sergey Kalinichenko

Reputation: 726549

Parameterize your insert. In addition to gaining an ability to insert strings with any characters that are valid inside nvarchar, you will also fix a major security problem by avoiding a potential sql injection attack:

var cmd = new SqlCommand("INSERT INTO Test5(P_Def) VALUES(@Def)", con);
cmd.Parameters.AddWithValue("@Def", pro.Definition);

Upvotes: 5

Related Questions