[RESOLVED] SQL Server doesn't like quotes!

[dglienna]

I have some memo fields, as well as NVCHAR() that has quotes in it.

What is the best solution to this? We need to copy ads that have quotes.

I've tried to double them up, but had a problem with memo's, so I deleted them temporarily.

[Alsvha]

If you mean the
' (single quotation mark, ping or what else it is called)
character - it should be escaped by itself meaning
'' (2 times ')

If you mean the
" (double quotation mark)
then SQL Server should have no problems with these inside text strings.

[HairyMonkeyMan]

Using parameters in your connection object also solves this.

[dglienna]

So I can have this?

"This is today's latest hit: 'This is It'"

as a parameter? if so, then that's the answer. thanks.

[HairyMonkeyMan]

Yessir.. remember to set the type in the parameter object.

[hspc]

I have some memo fields, as well as NVCHAR() that has quotes in it.

What is the best solution to this? We need to copy ads that have quotes.

I've tried to double them up, but had a problem with memo's, so I deleted them temporarily.
Can you give more explanation to the problem ? Or post the complete query that makes the problem so I can tell how to rewrite it?

[dglienna]

The problem was SQL Injection. Strings had ' marks, which ended the statement prematurely. Descriptions were pasted in from ad copy.

[hspc]

Depending on the language you use, you can stop SQL injection in several ways.
Some techniques are mentioned here (http://www.unixwiz.net/techtips/sql-injection.html#miti).
Parameterized queries are the best option for .net code.