views:

34

answers:

1

when i insert a specific value in MySQL table through code i get exception (1064 error)

i know the reason , but i don't know how to fix the problem,, all what i wanna to do is to store the relative path of my images in the image table then i get this exception all the time when the inserted string contains "\" or @"\".

how can i fix this problem

+1  A: 

Chances are you're embedding the values directly into your SQL. Don't do that: use a parameterized query instead, which will keep your SQL code separate from the data. This means you don't need to worry about formatting values or SQL injection attacks, and lets you reuse statements.

Jon Skeet
what ever i don't know how to use parametrized queries,but all what i want is to fix the problem , i need to save the path of image ,but i get (1064) error when i use "\\"
@just-name - You *really* should learn, there are [thousands of resources around parameterized queries](http://www.google.com/search?q=.net+mysql+parameterized+queries). SQL Injection is one of the easiest attacks to exploit...why not solve 2 problems at once here? I promise they're really, *really* easy to learn, take a look at a [simple example](http://www.programmingado.net/a-389/MySQL-NET-parameters-in-query.aspx).
Nick Craver
u are right ,thank u so much for your help.