转义PowerShell中包含单引号的字符串,以便为SQL查询做好准备

Question

我试图运行以下查询,它接受某人的名字,并尝试将其插入SQL Server数据库表.

$name = "Ronnie O'Sullivan"

$dataSource = "127.0.0.1"
$database = "Danny"
$connectionString = "Server=$dataSource;Database=$database;Integrated Security=True;"

$connection = New-Object System.Data.SqlClient.SqlConnection
$connection.ConnectionString = $connectionString
$connection.Open()

$query = "INSERT INTO People(name) VALUES('$name')"

$command = $connection.CreateCommand()
$command.CommandText = $query
$command.ExecuteNonQuery()

$connection.Close()

我面临的问题是单引号导致我的查询出现问题.查询正在执行

INSERT INTO People(name) VALUES('Ronnie O'Sullivan')

这会导致SQL语法错误.

我的问题是如何转义我的$ name变量,以便它在SQL端呈现.

一种解决方案是在我的$ name变量上进行查找和替换,找到:'replace:''

$name.Replace("'", "''")

那里有更优雅的解决方案,还是我似乎无法找到的功能？

谢谢.

Answer 1

您可以尝试更新代码以使用能够处理字符串中引号的参数化值:

$query = "INSERT INTO People(name) VALUES(@name)"

$command = $connection.CreateCommand()
$command.CommandText = $query
$command.Parameters.Add("@name", $name)  -- | Out-Null (may be required on the end)
$command.ExecuteNonQuery()

我对powershell没有经验,但是参考了这篇文章的参数化查询: