Escaping the ' character

[wjstarck]

How do I escape the ' character in the following code?

Code: Select all

string command = "INSERT INTO anesthpcpref(PCName,ChangeLog) VALUES ('" + POut.String(thisPCName) + "','" + POut.String(ChangeLog) + "'" + ")";
DataCore.NonQ(command);

If the ChangeLog string has a ' in it, it's breaking the MySQL query.

Thanks.

[wjstarck]

Well, OK, nevermind.

The UPDATE statement in this code block had an extra space between the " and the WHERE, which is what was actually breaking the MySQL

Code: Select all

if (GetPCName(thisPCName) == "")
            {
                string command = "INSERT INTO anesthpcpref(PCName,ChangeLog) VALUES ('" + POut.String(thisPCName) + "','" + POut .String(ChangeLog) + "'" + ")";
                DataCore.NonQ(command);
            }
            else
            {
                string command = "UPDATE anesthpcpref SET ChangeLog = '" + POut.String(ChangeLog) + "'" + " WHERE PCName = '" + POut.String(thisPCName) + "'";
                DataCore.NonQ(command);
            }