Hi All:
I am using a textbox to capture user entry to create a custom SQL select statement. I have everything working fine but while I was testing, I noticed something...
Suppose I wanted to search by last name and I entered, "O'Dooles" in the textbox. I would get an exception thrown at me since the apostrophe is used for SQL syntax. I got around that by using the Text.Replace method to swap the single apostrophe for a double one. That got me to thinking.
Are there any other characters I would need to watch for that could throw exceptions?
I'm also guessing there is a much better way to handle all of this. I have seen some of the security issues involved with this. I haven't done much looking into it but is using parameterized queries an option? Anything else?
...
Go to the complete details ...