我无法保存“ '' C＃中的那个角色 [英] I am unable to save " ' " that character in C#

问题描述

我无法在c＃

中保存

'这个字符。如果包含此'字符语法错误的任何名称即将到来。
 
错误是
'SHAMEERPET'附近的语法错误。\\ n在字符串后面的未标记的引号' '。
有一段时间会来
 
 
 
 我尝试过： 
 
 
 
如果我删除它会保存。但我补充说它会给出一些语法错误。所以如何保存该字符。
解决方案
 
永远不要连接字符串来构建SQL命令。它会让您对意外或故意的SQL注入攻击持开放态度，这可能会破坏整个数据库。请使用参数化查询。
 
 
 
尝试这样的事情：
 
 
  string  myData =  包含引号'character'的字符串; 
 使用（SqlConnection con =  new  SqlConnection（strConnect））
 {
 con.Open（）; 
 使用（SqlCommand cmd =  new  SqlCommand（   INSERT INTO myTable（myColumn）VALUES（@STR），con））
 {
 cmd.Parameters.AddWithValue（   @ STR，myData）; 
 cmd.ExecuteNonQuery（）; 
} 
} 
 
 
 
 
永远不要通过连接字符串来构建SQL查询。迟早，您将使用用户输入来执行此操作，这会打开一个名为SQL注入的漏洞，这对您的数据库很容易并且容易出错。
 
名称中的单引号你的程序崩溃。如果用户输入像Brian O'Conner这样的名称可能会使您的应用程序崩溃，那么这是一个SQL注入漏洞，崩溃是最少的问题，恶意用户输入，并且它被提升为具有所有凭据的SQL命令。 
 
  SQL注入 - 维基百科 [ ^ ] 
 
  SQL注入 [ ^ ] 
 
 
很可能是您将用户界面中的值直接连接到SQL语句，这会导致问题。要更正错误并确保SQL注入安全，请使用参数将值传递到数据库中。 
 
 
 
查看正确执行数据库操作 [ ^  
 
 
I am unable to save 
" '  " that character in c#
. If any name including this ' character syntax error is coming.

error is "
"Incorrect syntax near 'SHAMEERPET'.\r\nUnclosed quotation mark after the character string ''."
Some time it will come



What I have tried:



If I removed it will save. But I added that it will give some syntax error. so how to save that character.
解决方案
Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.



Try something like this:

string myData = "A string that includes a quote ' character";
using (SqlConnection con = new SqlConnection(strConnect))
    {
    con.Open();
    using (SqlCommand cmd = new SqlCommand("INSERT INTO myTable (myColumn) VALUES (@STR)", con))
        {
        cmd.Parameters.AddWithValue("@STR", myData);
        cmd.ExecuteNonQuery();
        }
    }

Never build an SQL query by concatenating strings. Sooner or later, you will do it with user inputs, and this opens door to a vulnerability named "SQL injection", it is dangerous for your database and error prone.

A single quote in a name and your program crash. If a user input a name like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability, and the crash is the least of the problems, a malicious user input and it is promoted to SQL commands with all credentials.

SQL injection - Wikipedia[^]

SQL Injection[^]

Most likely you are concatenating the values from the user interface directly to your SQL statement and this causes the problems. To correct the error and to be safe from SQL injections, use parameters to pass the values into the database. 



Have a look at Properly executing database operations[^]


                        
这篇关于我无法保存“ '' C＃中的那个角色的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！