VB.Net：在使用带单引号的变量的查询字符串中转义单引号

Question

我的程序正在处理的一些记录正在日志表中创建一条记录，内容如下：

仪器：“s”附近的语法不正确。字符串')))'后的非右引号。

代码使用内联查询，将字符串变量的值连接到 SELECT 和 SubQueries 中的 WHERE 子句。

代码：

SQL = "SELECT instrument_id, description, sub_category_of, meta_instrument" _
& " FROM instruments " _
& " WHERE  (instrument_id IN " _
& " (SELECT instrument_id " _
    & "FROM instruments " _
    & "WHERE (description = '" & strn & "'))) " _
        & "OR (instrument_id IN " _
        & "    (SELECT sub_category_of " _
        & "     FROM instruments AS instruments_1 " _
        & "     WHERE (description = '" & strn & "'))) " _
        & "OR (instrument_id IN " _
        & "    (SELECT meta_instrument " _
        & "     FROM instruments AS instruments_1 " _
        & "     WHERE (description = '" & strn & "')))"

对 sql server 执行的实际查询：

SELECT instrument_id, description, sub_category_of, meta_instrument _
FROM instrument_ref 
    WHERE  (instrument_id IN 
(SELECT instrument_id
    FROM instruments
    WHERE (description = 'Women's Choir'))) 
    OR (instrument_id IN 
        (SELECT sub_category_of
            FROM instruments AS instruments_1
            WHERE (description = 'Women's Choir')))
    OR (instrument_id IN
        (SELECT meta_instrument
            FROM instruments AS instruments_1
            WHERE (description = 'Women's Choir')))

我想就如何处理单引号寻求帮助，以便更正此错误。我是在“strn”变量中转义它，还是在内联查询中转义？

非常感谢。

Answer 1

按照建议，使用参数：

SQL = "SELECT instrument_id, description, sub_category_of, meta_instrument" _
& " FROM instruments " _
& " WHERE  (instrument_id IN " _
& " (SELECT instrument_id " _
    & "FROM instruments " _
    & "WHERE (description = @description))) " _
        & "OR (instrument_id IN " _
        & "    (SELECT sub_category_of " _
        & "     FROM instruments AS instruments_1 " ... etc

然后，当你用这条 SQL 构造 SqlCommand 对象时，使用命令对象的“.Parameters.AddWithValue()”方法添加一个名为“@description”的参数和适当的值。

顺便说一句，这可以防止某人通过输入“; drop table instruments;”的描述来造成破坏。