传递"从c#到sql server

Question

我试图传递一个包含字符"从c#到sql server使用的脚本"

thisCommand.ExecuteNonQuery();

问题是String在字符串内表示为"而不是":

thisCommand.CommandText = SQLscript; (string SQLScript)

如何将所有"字符转换为"以便在sql中我只得到"？

感谢阅读脚本的建议:

StreamReader s = new StreamReader("export_script.sql");
this.SQLscript = s.ReadToEnd();

执行脚本:

thisCommand.CommandText = SQLscript;
thisCommand.ExecuteNonQuery();

在脚本里面我有类似的东西:

set @cmd = 'bcp "'+ @cmd_select + '" queryout "' + @partname + '" -c -S ' + @@SERVERNAME 

你可以看到我使用"for bcp命令"

Answer 1

使用SQL参数.它会为你完成这项工作 - 不需要任何危险的追逐者

这是一个例子

        SqlConnection mySqlConnection = new SqlConnection("server=localhost;database=Northwind;uid=sa;pwd=sa");
        mySqlConnection.Open();
        SqlCommand mySqlCommand = mySqlConnection.CreateCommand();
        mySqlCommand.CommandText =
          "INSERT INTO Customers (" +
          "  CustomerID, CompanyName, ContactName" +
          ") VALUES (" +
          "  @CustomerID, @CompanyName, @ContactName" +
          ")";
        mySqlCommand.Parameters.Add("@CustomerID", SqlDbType.NChar, 5);
        mySqlCommand.Parameters.Add("@CompanyName", SqlDbType.NVarChar, 40);
        mySqlCommand.Parameters.Add("@ContactName", SqlDbType.NVarChar, 30);
        mySqlCommand.Parameters["@CustomerID"].Value = "J4COM";
        // The company name contains two double-quotes (") for demo purposes
        mySqlCommand.Parameters["@CompanyName"].Value = "J4 \"Company\"";
        mySqlCommand.Parameters["@ContactName"].IsNullable = true;
        mySqlCommand.Parameters["@ContactName"].Value = DBNull.Value;
        mySqlCommand.ExecuteNonQuery();
        Console.WriteLine("Successfully added row to Customers table");

        mySqlConnection.Close();
    }
}