CODEWITHSUNDEEP
c#oracle-databaseado.netsql-injection
Jimenemex
Jimenemex

Reputation: 3166

Add quotes around SQL parameter value?

I'm unsure if I'm supposed to add single quotes '' around an SQL parameter when it's a string value that is already populated with data. My thinking is I don't because by using the OracleParameter constructor, it'll automagically get it's data type changed to string.

Specifically, should I be doing this: '@c' over just @c when doing this: SELECT @c FROM Dual when @c is a string already when placed into the OracleParameter constructor?

string calcDateFormat = "Some Data";

try
{
    string sql = "SELECT @c ColumnName FROM Dual";
    // Or should it be this
    string sql = "SELECT '@c' ColumnName FROM Dual";

    using(OracleCommand command = new OracleCommand(sql, this.Connection))
    {
        OracleDataAdapter adapter = new OracleDataAdapter(command);
        adapter.SelectCommand.Parameters.Add(new OracleParameter("@c", OracleDbType.Varchar2, calcDateFormat, ParameterDirection.Output));
        DataSet dataset = new DataSet();
        adapter.Fill(dataset);
        return dataset;
    }
}
catch (OracleException ex)
{
    throw ...
}

// SELECT => 
//        Column: ColumnName
//        Row:    Some Data

Upvotes: 1

Views: 1867

Answers (2)

Parth Kale
Parth Kale

Reputation: 38

No there is no need to add quotes as this code below will work just fine, 

 string sql = "SELECT @c ColumnName FROM Dual";

The reason is if you write '@c' it will search for the matching parameter name in the place you are declaring the parameters and it wont match the query would break.

Upvotes: 1

Schytheron
Schytheron

Reputation: 735

I think you can keep it as just string sql = "SELECT @c FROM Dual"; without the single quotes. That is at least how I write my SQL queries in PHP. I don't know however if the rules are different for C# and Oracle.

Your best chance of answering your question is by trying out both methods and see what happens.

Upvotes: 1

Related Questions