Click here to Skip to main content
15,879,326 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
I'm using following piece of HTML mark-up to Insert Name which includes Apostrophe in the Database.

HTML
Text='<%# DataBinder.Eval(Container.DataItem, "Name").ToString().Replace("'","''") %>'


But I m getting the error "server tag is not well formed". Tried a lot but could not figure out what is the problem!

Any help will be appreciated.
Posted
Comments
ZurdoDev 2-Feb-16 12:41pm    
Try .Replace("''", "''''")
or
.Replace("\'","\'\'")

1 solution

You should be able to use:
aspx
Text='<%# Eval("Name", "{0}").Replace("&apos;","&apos;&apos;") %>'


HOWEVER, your comment about inserting the name into the database suggests that you are writing code which is vulnerable to SQL Injection[^]. If you use a properly parameterized query, there will be no need to replace or escape any "special" characters in your values.

SQLi is a very serious security vulnerability, which is extremely easy to exploit. You need to fix this vulnerability in your code ASAP.


Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]
SQL injection attack mechanics | Pluralsight [^]
 
Share this answer
 
Comments
Hapisha 2-Feb-16 17:11pm    
I try to use your fix on my gridview Label.But, all the row from that gridview can be inserted except the row containing the name(Label) with apostrophe.

Cmd.Parameters.Add("@Name", SqlDbType.VarChar).Value = LastFirst;

And I hope Im using parameterized query.
Richard Deeming 3-Feb-16 9:49am    
What's the error message?
Hapisha 3-Feb-16 13:32pm    
There are no error messages. Just the row with apostrophe did not insert. Other rows are inserted perfectly.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900