Noticing that you seem to work in ASP.NET, use parameterized queries. This ALONE will save you COUNTLESS man hours of manual stripping, converting, etc.
I'm not saying that you should rely solely on Parameters, but I have used parameterized queries since the start and not only do they make my apps easier to read (which minimizes development and maintenance times) but they do a **** fine job of handling data and making sure it's given to the database correctly.
Using Conn As New MySqlConnection(Settings.MySqlConnectionString)
Using Cmd As New MySqlCommand("SELECT this, that FROM table WHERE this=?this AND that=?that LIMIT 5", Conn)
With Cmd.Parameters
.Add(New MySqlParameter("?this",Request.QueryString("This")))
.Add(New MySqlParameter("?that",txtTextbox.Text))
End With
Conn.Open()
Using DR As MySqlDataReader = Cmd.ExecuteReader()
If DR.Read() Then
output = DR(0) & " " & DR(1)
End If
End Using
End Using
End Using |
And of course the MS SQL Equivilent...
Using Conn As New SqlConnection(Settings.SqlConnectionString)
Using Cmd As New SqlCommand("SELECT TOP 5 this, that FROM table WHERE this=@this AND that=@that", Conn)
With Cmd.Parameters
.Add(New SqlParameter("@this",Request.QueryString("This")))
.Add(New SqlParameter("@that",txtTextbox.Text))
End With
Conn.Open()
Using DR As SqlDataReader = Cmd.ExecuteReader()
If DR.Read() Then
output = DR(0) & " " & DR(1)
End If
End Using
End Using
End Using |
More about Parameterized Queries...
http://aspnet101.com/aspnet101/tutorials.aspx?id=1
PS... these aren't just for selects/queries... they're for anywhere you need to pass info from the app server to the db server. Updates/deletes/inserts should all utilize parameterized queries/commands.
