c# - error 42601 syntax error at or near -


i'm using c# application load postgresql table appropriate data. here code:

npgsqlconnection conn = new npgsqlconnection("server=localhost;port=5432;userid=postgres;password=***** ;database=postgres;"); npgsqlcommand command = new npgsqlcommand(); command.connection = conn; conn.open(); try {   command.commandtext = "insert projets (id, title, path, description, datecreated) values('" + pro.id + "','" + pro.title + "','" + pro.path + "', '' ,'" + pro.datecreated + "')";   command.executenonquery(); } catch {   throw; } conn.close(); 

however, when executing code, keep getting same error:

error 42601 syntax error @ or near... 

i didnt find how escape apostroph.

try write command using parametrized query

command.commandtext = "insert projets (id, title, path, description, datecreated) " +                       "values(@id, @title, @path, '', @dt);"; command.parameters.addwithvalue("@id", pro.id); command.parameters.addwithvalue("@title", pro.title); command.parameters.addwithvalue("@path", pro.path) command.parameters.addwithvalue("@dt", pro.datecreated); command.executenonquery(); 

in way, if 1 of strings values contain single quote, leave job correctly parse values framework code , avoid problems sql injection


Comments

Popular posts from this blog

jquery - How can I dynamically add a browser tab? -

node.js - Getting the socket id,user id pair of a logged in user(s) -

keyboard - C++ GetAsyncKeyState alternative -