Problems Inserting in a database

[norminator]

Hey guys I am having some problems inserting a string into a database


Error: Syntax error in query string statement
Field type: Memo

Below is the code

string backupcall = "INSERT INTO tblPortLine (Line) VALUES ('" + RECORD + "')";

After debugging the program I realised that the string RECORD which receives data from a serial port contains an apostrophe ' which clashes with the syntax used in the INSERT statement.

For example:

RECORD may be equal to:
26/02/08 10:56AM 4128 0006 9228693- 00:02'16 00000.00 TR

If you look carefully there is an apostrophe between the numbers 2'16.

My question to you now guys is:
Is there a way for the INSERT statement to get around that?

[hassanvoyeau]

Better to use a stored procedure and pass in a parameter.

[norminator]

Better to use a stored procedure and pass in a parameter.

Thanks it worked a guess I wasnt thinking alont that path; but It seems as if there isnt a way to do this without using a stored procedure.

[hassanvoyeau]

Thanks it worked a guess I wasnt thinking alont that path; but It seems as if there isnt a way to do this without using a stored procedure.

Actually you don't need to use a stored procedure to use parameters in code (at least that the case in VB.NET). But I prefer stored procedure cause then I could most likely make changes to the SP without having to change the code and recompile.

[sking]

The answer to your question is yes.

[norminator]

The answer to your question is yes.

well i was using c# and i got the problem. thanks though youth