What characters should be escaped in sql string parameters

Question

I need a complete list of characters that should be escaped in sql string parameters to prevent exceptions. I assume that I need to replace all offensive characters with a shielded version before passing it to the ObjectDataSource filter parameter.

Answer 1

No, the ObjectDataSource object will handle all the escaping for you. Any parameterized query also does not require escaping.

Answer 2

, 99% , - , , . - . , , (, MySQL mysql_real_escape_string).

Answer 3

SQL: :

, . , , . , \x0000, , \x0000 .

, escape-. escape- .

\  

\  Backspace

\  

\  

\ g Carriage return

\ t Horizontal tab

\ v Vertical tab

\ "Quotation mark

\ Backslash

\ xhhhh Unicode character in hexadecimal notation

Answer 4

Here I used to get rid of the apostrophes. You can do the same with other offensive characters you encounter. (example in VB.Net)

Dim companyFilter = Trim(Me.ddCompany.SelectedValue)

If (Me.ddCompany.SelectedIndex > 0) Then
      filterString += String.Format("LegalName like '{0}'", companyFilter.Replace("'", "''"))
End If

Me.objectDataSource.FilterExpression = filterString

Me.displayGrid.DataBind()