As softhemc shows, that's not a problem for SQL Server, as the string delimiters here are single quotes and not double quotes.
Do you have a problem in .NET? In C# for example single quotes only delimit chars, single chars. To have a duoble quote in a double quoted string you prefix it with a \ or use a double double quote ""
Besides, this is really only a problem in writing this in source code. If the value comes from a form a string can contain anything, also single quotes, as it's entered into a control and there are no delimiters needed for that. To pass this on you use paramters as you plan and don't have to fear sql injection. Your query code itself will then need to contain ? or @var. Depends on what client language you use, again.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.