sql query vs special characters omit

Accepted answer

Hi Jayraj,

It is not good practice to use input values direct in inline query. Make your input values with parameter values so there is no chance of SQL injection via your text imput. So please change inline query with parameter.

https://www.aspforums.net/Threads/259229/Passing-parameter-to-inline-SqlCommand-insert-query-using-C-in-ASPNet/

+1

Amit Mohanty6y ago

Hey add parameter to command instead of inline query.

SqlCommand cmd = new SqlCommand(
"Insert Into tblCountry(cName, cCode) Values(@cName, @cCode)", conn);
SqlParameter param = new SqlParameter();
param.ParameterName = "@cName";
param.Value = textBox1.Text;
param.ParameterName = "@cCode";
param.Value = textBox2.Text;
cmd.Parameters.Add(param);
cmd.ExecuteNonQuery();

0

Ramachandran M6y ago

Hi,

Use

Server.HtmlEncode and Server.HtmlDecode

0