Escaping apostrophe when inserting into sql database

[mister-Ed]

I have a datagrid, and when initializing my field variables, I need to
double up apostrophes so they are accepted into SQL dbase. In the line
below, i'm trying to do this with the Replace function, but i still
get an error when entering an apostrophe:

Dim sCompany As String = CType(e.Item.Fi ndControl("text box3"),
textbox).Text.R eplace("'", "''")

???
Mr. Ed

[=?Utf-8?B?S2VycnkgTW9vcm1hbg==?=]

mister-Ed,

If you use parameters to supply variable data then you should not need to
worry about escaping apostrophes.

Parameters will also help guard agains SQL Injection attacks.

Kerry Moorman
"mister-Ed" wrote:

I have a datagrid, and when initializing my field variables, I need to
double up apostrophes so they are accepted into SQL dbase. In the line
below, i'm trying to do this with the Replace function, but i still
get an error when entering an apostrophe:

Dim sCompany As String = CType(e.Item.Fi ndControl("text box3"),
textbox).Text.R eplace("'", "''")

???
Mr. Ed

[Phill W.]

mister-Ed wrote:

I need to double up apostrophes so they are accepted into SQL dbase.
In the line below, i'm trying to do this with the Replace function,
but i still get an error when entering an apostrophe:

As ever ... /what/ error???

Dim sCompany As String = CType(e.Item.Fi ndControl("text box3"),
textbox).Text.R eplace("'", "''")

That could get you a NullReferenceEx ception, a TypeCastExcepti on, or any
others that the Framework might feel like throwing at you.

Dim sCompany As String = String.Empty
Dim tb as TextBox _
= DirectCast( e.Item.FindCont rol("textbox3") )
If Not ( tb Is Nothing ) Then
sCompany = tb.Text
End If

sSQL = "update ... "
& set ... = '" & sCompany.Replac e("'", "''") & "'"

HTH,
Phill W.