I currently use MySql, but would prefer an ODBC solution to make it future proof.
How do I sanitize user input before passing it to an ODBC database ?
And, while I'm at it, I wrap my string in double quotes, e.g. "INSERT INTO VALUES(description) ""` - but what if the text itself contains a double quote?
Answer
Try using a parametrized SQL sentence
like this.
INSERT INTO MyTable (Field1,Field2) VALUES (:Param1,:Param2)
check this article from embarcadero for more info about how use parameters Using Parameters in Queries.
No comments:
Post a Comment