How to deal with single and double quotes

in .NET VB

[txbakers]

In ASP I converted the field to a string and did a regexp to swap out the ' with a '' before sending it to the DB.

How do I do that in VB.NET?

Thanks.

[mattglet]

[msdn.microsoft.com...]

Might get you on your way...

[TheNige]

The best way is not to use dynamic sql queries where single quotes mess everything up. User parameterized queries or stored procedures. That way you can send the string with single quotes to the databse with no problems.

[txbakers]

cool, thanks.

[Xoc]

Concatinating to create SQL is a bad idea anyway, because it allows SQL injection attacks. For example, suppose that you form a query by using

strSQL = "Select Salary From Employees where EmployeeId=" & empid

And someone types

1 or 1=1

into the field. Now the query doesn't return just one record, it returns all of them. Parameterized queries is always the way to go.

[txbakers]

the examples I have are for SQL server using the @ symbol. What is it for mySQL?

I'd be glad to use parameters if I can find the correct syntax.

[TheNige]

4GuysFromRolla has a tutorial on how to use them...

They use "?" in the SQL query and then when you add parameters to the command object it will replace the? with the parameter value...in the order that you added the parameters.

That was for the oledb provider...is that what you use for mySQL?

[txbakers]

No, I'm using a native mySQL connector written by CoreLabs. It's really cool.

Next two questions:
The button must be clicked to post the form. Is there a way to press the enter key and have it submit like in regular HTML and ASP?

Is there a way to make a warning before deleting a line from a datagrid? (other than onClick javascript)

There will be millions more questions as I get involved in .NET. I like it so far.

[TheNige]

Yes, there are ways to add warnings before deletes and to set entere key for submit...a google search will usually bring results for those as it is a common thing to do.

A lot of things to add client-side events or properties to asp controls is done with the yourcontrol.attributes.add method...so take a look at how to use that.

4GuysFromRolla has about 12 articles on how to use the datagrid that are very good for learning common tasks.