Insert string into SQL query without quotes

up vote
-4
down vote

favorite

I need to make a query that looks like this:

SELECT * FROM Table WHERE Row.DATA = value

Where DATA I need to pass through SqlParameter. If I do something like this:

string value = "DATA";
SqlCommand sql = new SqlCommand("SELECT * FROM Table WHERE Row.@Val = value");
sql.Parameters.Add("@Val", SqlDbType.VarChar).Value = value;

I get following query which is invalid:

SELECT * FROM Table WHERE Row.'DATA' = value

edited yesterday

Bradley Grainger

19.2k36386

asked yesterday

Vlad Gavrilov

New contributor

2

The Parameter is supposed to be your value, not data
– Hooman
yesterday

1

SqlParameters used to provide values, they're not intended to pass table names, schemas or other things than potentially assigned values.
– Tetsuya Yamamoto
yesterday

Additionally, try PREPARE stmt1 FROM "yourqueryhere" then EXECUTE stmt1 USING @Val to execute the query.
– Tetsuya Yamamoto
yesterday

add a comment |

up vote
-4
down vote

favorite

I need to make a query that looks like this:

SELECT * FROM Table WHERE Row.DATA = value

Where DATA I need to pass through SqlParameter. If I do something like this:

string value = "DATA";
SqlCommand sql = new SqlCommand("SELECT * FROM Table WHERE Row.@Val = value");
sql.Parameters.Add("@Val", SqlDbType.VarChar).Value = value;

I get following query which is invalid:

SELECT * FROM Table WHERE Row.'DATA' = value

edited yesterday

Bradley Grainger

19.2k36386

asked yesterday

Vlad Gavrilov

New contributor

2

The Parameter is supposed to be your value, not data
– Hooman
yesterday

1

SqlParameters used to provide values, they're not intended to pass table names, schemas or other things than potentially assigned values.
– Tetsuya Yamamoto
yesterday

Additionally, try PREPARE stmt1 FROM "yourqueryhere" then EXECUTE stmt1 USING @Val to execute the query.
– Tetsuya Yamamoto
yesterday

add a comment |

up vote
-4
down vote

favorite

I need to make a query that looks like this:

SELECT * FROM Table WHERE Row.DATA = value

Where DATA I need to pass through SqlParameter. If I do something like this:

string value = "DATA";
SqlCommand sql = new SqlCommand("SELECT * FROM Table WHERE Row.@Val = value");
sql.Parameters.Add("@Val", SqlDbType.VarChar).Value = value;

I get following query which is invalid:

SELECT * FROM Table WHERE Row.'DATA' = value

edited yesterday

Bradley Grainger

19.2k36386

asked yesterday

Vlad Gavrilov

New contributor

I need to make a query that looks like this:

SELECT * FROM Table WHERE Row.DATA = value

Where DATA I need to pass through SqlParameter. If I do something like this:

string value = "DATA";
SqlCommand sql = new SqlCommand("SELECT * FROM Table WHERE Row.@Val = value");
sql.Parameters.Add("@Val", SqlDbType.VarChar).Value = value;

I get following query which is invalid:

SELECT * FROM Table WHERE Row.'DATA' = value

edited yesterday

Bradley Grainger

19.2k36386

asked yesterday

Vlad Gavrilov

New contributor

edited yesterday

Bradley Grainger

19.2k36386

asked yesterday

Vlad Gavrilov

New contributor

edited yesterday

Bradley Grainger

19.2k36386

edited yesterday

Bradley Grainger

19.2k36386

edited yesterday

Bradley Grainger

19.2k36386

asked yesterday

Vlad Gavrilov

New contributor

asked yesterday

Vlad Gavrilov

asked yesterday

Vlad Gavrilov

New contributor

Vlad Gavrilov is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

2

The Parameter is supposed to be your value, not data
– Hooman
yesterday

1

SqlParameters used to provide values, they're not intended to pass table names, schemas or other things than potentially assigned values.
– Tetsuya Yamamoto
yesterday

Additionally, try PREPARE stmt1 FROM "yourqueryhere" then EXECUTE stmt1 USING @Val to execute the query.
– Tetsuya Yamamoto
yesterday

add a comment |

2

The Parameter is supposed to be your value, not data
– Hooman
yesterday

1

SqlParameters used to provide values, they're not intended to pass table names, schemas or other things than potentially assigned values.
– Tetsuya Yamamoto
yesterday

Additionally, try PREPARE stmt1 FROM "yourqueryhere" then EXECUTE stmt1 USING @Val to execute the query.
– Tetsuya Yamamoto
yesterday

The Parameter is supposed to be your value, not data
– Hooman
yesterday

SqlParameters used to provide values, they're not intended to pass table names, schemas or other things than potentially assigned values.
– Tetsuya Yamamoto
yesterday

Additionally, try PREPARE stmt1 FROM "yourqueryhere" then EXECUTE stmt1 USING @Val to execute the query.
– Tetsuya Yamamoto
yesterday

add a comment |

1 Answer
1

active

oldest

votes

up vote
1
down vote

string value = "DATA";
SqlCommand sql = new SqlCommand($"SELECT * FROM Table WHERE Row.value = value");

answered yesterday

Antoine V

4,7942422

1

I know that this is one simple solution. But isn't it insecure?
– Vlad Gavrilov
yesterday

1

This will work only if the OP is extremely careful and only uses known strings for value.
– Panagiotis Kanavos
yesterday

@VladGavrilov I think it's security because injection come from the value (in the right), with a strange value for the column , the query will fail
– Antoine V
yesterday

add a comment |

Your Answer

StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);

);

Vlad Gavrilov is a new contributor. Be nice, and check out our Code of Conduct.

draft saved

draft discarded

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53205214%2finsert-string-into-sql-query-without-quotes%23new-answer', 'question_page');

);

Post as a guest

Name

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
1
down vote

string value = "DATA";
SqlCommand sql = new SqlCommand($"SELECT * FROM Table WHERE Row.value = value");

answered yesterday

Antoine V

4,7942422

1

I know that this is one simple solution. But isn't it insecure?
– Vlad Gavrilov
yesterday

1

This will work only if the OP is extremely careful and only uses known strings for value.
– Panagiotis Kanavos
yesterday

@VladGavrilov I think it's security because injection come from the value (in the right), with a strange value for the column , the query will fail
– Antoine V
yesterday

add a comment |

up vote
1
down vote

string value = "DATA";
SqlCommand sql = new SqlCommand($"SELECT * FROM Table WHERE Row.value = value");

answered yesterday

Antoine V

4,7942422

1

I know that this is one simple solution. But isn't it insecure?
– Vlad Gavrilov
yesterday

1

This will work only if the OP is extremely careful and only uses known strings for value.
– Panagiotis Kanavos
yesterday

@VladGavrilov I think it's security because injection come from the value (in the right), with a strange value for the column , the query will fail
– Antoine V
yesterday

add a comment |

up vote
1
down vote

string value = "DATA";
SqlCommand sql = new SqlCommand($"SELECT * FROM Table WHERE Row.value = value");

answered yesterday

Antoine V

4,7942422

string value = "DATA";
SqlCommand sql = new SqlCommand($"SELECT * FROM Table WHERE Row.value = value");

answered yesterday

Antoine V

4,7942422

answered yesterday

Antoine V

4,7942422

answered yesterday

Antoine V

4,7942422

answered yesterday

Antoine V

4,7942422

1

I know that this is one simple solution. But isn't it insecure?
– Vlad Gavrilov
yesterday

1

This will work only if the OP is extremely careful and only uses known strings for value.
– Panagiotis Kanavos
yesterday

@VladGavrilov I think it's security because injection come from the value (in the right), with a strange value for the column , the query will fail
– Antoine V
yesterday

add a comment |

1

I know that this is one simple solution. But isn't it insecure?
– Vlad Gavrilov
yesterday

1

This will work only if the OP is extremely careful and only uses known strings for value.
– Panagiotis Kanavos
yesterday

@VladGavrilov I think it's security because injection come from the value (in the right), with a strange value for the column , the query will fail
– Antoine V
yesterday

I know that this is one simple solution. But isn't it insecure?
– Vlad Gavrilov
yesterday

This will work only if the OP is extremely careful and only uses known strings for value.
– Panagiotis Kanavos
yesterday

@VladGavrilov I think it's security because injection come from the value (in the right), with a strange value for the column , the query will fail
– Antoine V
yesterday

add a comment |

Vlad Gavrilov is a new contributor. Be nice, and check out our Code of Conduct.

draft saved

draft discarded

Vlad Gavrilov is a new contributor. Be nice, and check out our Code of Conduct.

draft saved

draft discarded

Post as a guest

Name

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Dfyjkt