T-SQL escape quote character

16,173

This will work:-

INSERT INTO [pugraider].[dbo].[Realms]([Name]) VALUES('Aman''Thul')

Ordinarily the only reason to have such hardcoded values in T-SQL is in DB construction code such as initialising look up tables.

Otherwise this code might be a result of string concatenation to build up some T-SQL from some input source. If that is the case its worth finding ways to avoid it since it can open your application to SQL injection attacks.

Share:
16,173
THX-1138
Author by

THX-1138

Updated on June 05, 2022

Comments

  • THX-1138
    THX-1138 about 2 years

    NOTE: It's probably a duplicate but I can't find working answer.

    Following is what i'm trying todo, notice a ' in the value. How do I fix this?

    INSERT INTO [pugraider].[dbo].[Realms]([Name]) VALUES('Aman'Thul')

    I use MS SQL Server Management Studio 2008.

    EDIT: I'm writing a script to populate a lookup table (ID<->Name).