query with "special" character to save

[jason213123]

hi,
i need perform the following query to save into db the problem is sometimes the user
enter some characteres that interfer with the sql command for example

if the user enter this word: 'hello'
when i try save this result i error because the final query is this:

insert into x (v) values (''hello'') and for update this problem ocorr to
how can i save the value ' to the db replacing the ' charater for other?
thanks a lot for your help :)

[sotoasty]

Use parameterized queiries.


DIM ID as integer = 15
dim MyName as String = "O'Riely"
SqlCommand.CommandText = "UPDATE TABLE SET MyName=@MN WHERE ID=@ID"
SqlCommand.Parameters.AddWithValue("@MN",MyName)
SqlCommand.Parameters.AddWithValue("@ID",ID)
SqlCommand.ExequteNonQuery