Escape special characters in MySQL using C# and ASP.Net

If you are using Mysql client library, You can use this functions

 MySql.Data.MySqlClient.MySqlHelper.EscapeString("YOUR DATA STRING")

In your case:

MySQLCommand cmd = new MySQLCommand("",conn);
cmd.CommandText = "INSERT INTO blogEntry (entryText) VALUE ('"+MySql.Data.MySqlClient.MySqlHelper.EscapeString(entryText)+"');";

It would be better to use a parameterized query. That way you would not need to escape characters, and it would (more importantly) help prevent an SQL injection attack.

cmd.CommandText = "INSERT INTO blogEntry (entryText) VALUES (@myvalue)"

And then something along the lines of:

cmd.Parameters.AddWithValue("@myvalue", TextBox1.Text);

You should use parameterized SQL at least, otherwise your attempts at sanitizing input could leave you open to SQL Injection.

Check here.

Something like:

cmd.CommandText = "INSERT INTO blogEntry (entryText) VALUE (?entryText)";
cmd.Parameters.Add("?entryText", MySqlDbType.VarChar, 255, textBox1.text); 

You can use Regular expression to replace special chars. Also .Net provide RegEx class which has Escape method to replace special chars which Escapes a minimal set of characters (\, *, +, ?, |, {, [, (,), ^, $,., #, and white space) by replacing them with their escape codes.

MySQLCommand cmd = new MySQLCommand("",conn);
cmd.CommandText = "INSERT INTO blogEntry (entryText) VALUE (" + Regex.Escape(textBox1.text) + ");";

http://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex.escape.aspx

Here's a simple way to escape any unwanted characters. Suppose the characters inside the curly brackets are the characters you want to avoid.

char[] charsToTrim = { 'O','R', '`', ' ', '\'', '=', '1' , '-', ';'};  

string value = " `admin` OR 1=1;-- ";

lblescape.Text = value.Trim(charsToTrim);

The Trim(char[]) will avoid all the unwanted characters but it has its own disadvantages such as you cannot use the character "O" or "R" even though you want them to use, but I guess you can make some arrangements to it..

You would absolutely want to use parameters in this case. It will avoid the escaping issue and also protect you against SQL injection attacks (to which this code is currently vulnerable).

To use parameters, your code would look like:

MySQLCommand cmd = new MySQLCommand("",conn);
cmd.CommandText = "INSERT INTO blogEntry (entryText) VALUE (?entryText);";

Then afterwards, you would initialize the parameter. Something like:

cmd.Parameters.Add("?entryText", textBox1.Text);