Escape single quotes for sql injection

tskong · tskong · commit 77de282fe1bf · 2022-02-09T10:22:15.000Z
diff --git a/QueryBuilder/SqlResult.cs b/QueryBuilder/SqlResult.cs
@@ -81,7 +81,7 @@ private string ChangeToSqlValue(object value)
             }
 
             // fallback to string
-            return "'" + value.ToString() + "'";
+            return "'" + value.ToString().Replace("'","''") + "'";
         }
     }
 }

Original file line number	Diff line number	Diff line change
`@@ -81,7 +81,7 @@ private string ChangeToSqlValue(object value)`
`81`	`81`	`}`
`82`	`82`
`83`	`83`	`// fallback to string`
`84`		`- return "'" + value.ToString() + "'";`
	`84`	`+ return "'" + value.ToString().Replace("'","''") + "'";`
`85`	`85`	`}`
`86`	`86`	`}`
`87`	`87`	`}`