Quotation character problem in SQL command

Question

Hi I want to search a string(with special characters) in DB but it has quotation character. I tryed lot of things but it didnt work. String is; '':;'xx' How may search this string with a select command? Select * FROM table where String='' Regards.

Vulpes · Answer

Perhaps having doubled the embedded quotes it is just a conversion problem. I'd try: Select * FROM table where CAST(String AS varchar) = ''':;''xx'

Sam Hobbs · Answer

Would a parameterized query solve the problem? If so then that should have been suggested. I know that many experienced database programmser say that we need to always use parameterized queries.

yokzu · Answer

Thanks Guys for your helps. It solved my problem Vulpes:)

Chintan Rathod · Answer

try to implement this one... Select * FROM table where String=':;''xx''' (single quote)(double quote):;(single quote)(single quote)xx(single quote)(single quote)(single quote)

yokzu · Answer

Error is ; The data types text and varchar are incompatible in the equal to operator.

yokzu · Answer

Thanks for your reply Chintan. But I try this method so I doubled the quote characters but it still didnt work. My query is like this when I doubled quotation but its getting error. Select * FROM table where String=''''':;''xx''' The string which I wanna search is ; '':;'xx'

Chintan Rathod · Answer

When the SQL statement is assembled via string concatenation the appearance of a single quote inside the QueryString value will break the statement. For example when built the statement will look like this: SELECT * FROM TableName WHERE FieldName = 'QueryString's Value' This is broken as the value closing delimiter appears twice; that is there are an odd number of single quotemarks. Solution For most DBMS doubling the single-quote character is the default means of escaping a single-quote. SELECT * FROM TableName WHERE FieldName = ' + replace(Request.QueryString(ProNumber) ' '') + ' This fix will produce the following statement: SELECT * FROM TableName WHERE FieldName = 'QueryString''s Value'