c# - error 42601 syntax error at or near -
i'm using c# application load postgresql table appropriate data. here code:
npgsqlconnection conn = new npgsqlconnection("server=localhost;port=5432;userid=postgres;password=***** ;database=postgres;"); npgsqlcommand command = new npgsqlcommand(); command.connection = conn; conn.open(); try { command.commandtext = "insert projets (id, title, path, description, datecreated) values('" + pro.id + "','" + pro.title + "','" + pro.path + "', '' ,'" + pro.datecreated + "')"; command.executenonquery(); } catch { throw; } conn.close();
however, when executing code, keep getting same error:
error 42601 syntax error @ or near...
i didnt find how escape apostroph.
try write command using parametrized query
command.commandtext = "insert projets (id, title, path, description, datecreated) " + "values(@id, @title, @path, '', @dt);"; command.parameters.addwithvalue("@id", pro.id); command.parameters.addwithvalue("@title", pro.title); command.parameters.addwithvalue("@path", pro.path) command.parameters.addwithvalue("@dt", pro.datecreated); command.executenonquery();
in way, if 1 of strings values contain single quote, leave job correctly parse values framework code , avoid problems sql injection
Comments
Post a Comment