3

I want to Execute a line of SQL which looks like this:

conn.Open();
var db = new PetaPoco.Database(conn);
var sql = "INSERT INTO FOO (name) VALUES ( 'foo@bar.com')";
var response = db.Execute(sql);

The problem is that PetaPoco thinks @bar is a parameter. Is there a way to tell it not to treat any @'s specially? My super lame work around was to replace "@" with "at". I live with this shame.

Daniel Williams
  • 8,912
  • 15
  • 68
  • 107

2 Answers2

5

"You are doing it wrong"™

To avoid SQL Injection attacks, and other minuances concatenting strings, you should use parameters:

var response = db.Execute("INSERT INTO FOO (name) VALUES (@0)", "foo@bar.com");

Wrong way, but works at least:

var response = db.Execute("INSERT INTO FOO (name) VALUES ('foo@@bar.com')",
Eduardo Molteni
  • 38,786
  • 23
  • 141
  • 206
2

You need to use two @ characters to escape it. I think this should work:

var sql = "INSERT INTO FOO (name) VALUES ( 'foo@@bar.com')"
Alan Burstein
  • 7,770
  • 1
  • 15
  • 18