Handling single quotes in string sql query using variables

Question

I am trying to make this statement safe from the insertion of special characters. How would I reformat the query to handle this, such as the variable type having the value “Women’s”? I know that parameterized queries are the way to go, however; that is not an option right now.

var sqlStatement = "SELECT DISTINCT DN FROM tbl1 WHERE Media LIKE "+ media + "% AND Type = " + type + "";

Check out the concept of Parameterised Queries or Prepared Statements. You should not be building up your query by directly concatenating strings in to it. — MatBailie
– MatBailie, Commented Oct 8, 2012 at 13:53
Is this node.js or is this JavaScript running in the browser? — epascarello
– epascarello, Commented Oct 8, 2012 at 14:07

xelco52 · Accepted Answer · 2012-10-09 22:50:14Z

2

Your best resource here is going to be OWASP (check out the SQL Injection Prevention cheat sheet). I feel compelled to reiterate that your best bet would be to attempt solutions in the following order:

Prepared Statements
Stored Procedures
Escaping User Supplied Input

If you're absolutely set on escaping queries for SQL Server you can refer to This MSDN Article, specifically the Escaping Input section. If you can further validate user input by implementing a White List, all the better!

answered Oct 9, 2012 at 22:50

xelco52

5,3754 gold badges43 silver badges57 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

podiluska · Accepted Answer · 2012-10-08 13:54:12Z

-1

I know that parameterized queries are the way to go, however; that is not an option right now.

Why is it "not an option right now"?

Is having your entire data compromised or destroyed "an option right now"? Would you care to post your URL?

If you don't parameterise your queries, there is no guaranteed foolproof method of preventing SQL injection.

answered Oct 8, 2012 at 13:54

podiluska

51.6k7 gold badges102 silver badges105 bronze badges

1 Comment

jbabey Over a year ago

why are people downvoting this? parameterized queries are the correct way to fix this.

Collectives™ on Stack Overflow

Handling single quotes in string sql query using variables

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related