Handling single quotes when inserting records

Because of the content, the title may contain single quotes, the direct use of SQL INSERT command will be an error, there are two ways to do this, one is to replace single quotes into two single quotes, the 2nd way is to use stored procedures.

The format of the table Mybbs is defined as follows:
CREATE TABLE [dbo]. [Mybbs] (
[ID] [bigint] IDENTITY (1, 1) is not NULL,
[Title] [Char] (160) COLLATE chinese_prc_ci_as NULL,
[Author] [Char] (m) COLLATE chinese_prc_ci_as NULL,
[Date_of_created] [DateTime] Null
[Abstract] [Char] (COLLATE) Chinese_prc_ci_as NULL,
[Content] [ntext] COLLATE Chinese_prc_ci_as not NULL
) on [PRIMARY] textimage_on [PRIMARY]

1. Replace single quotes with two single quotes:
SqlConnection coredb=new SqlConnection ();
coredb.connectionstring= "Workstation id=/" gqa-eric-lv/";p acket size=4096;integrated Security=sspi;"
"Data source=/" gqa-eric-lv/";p ersist security info=false;initial catalog=coredb";

Single quotes are replaced with "'" to insert ' into SQL Server;
String Title=textbox1.text.replace ("'", "" ");
String Content=textbox2.text.replace ("'", "" ");
if (title.trim () = = "" | | Content.trim () = = "") return;
String Insertcmd =@ "insert into Mybbs (title,content) Values (' + Title +" ', ' "+content+") ";

SqlCommand mycommand = new SqlCommand (insertcmd,coredb);
Coredb.open ();
SqlDataReader myreader = Mycommand.executereader ();
Myreader.close ();
Coredb.close ();

2, using stored procedures to insert

1 Create the stored procedure:
Create proc Insertmybbsproc (@Title char (160), @Author char (), @Content ntext)
As
Insert into Mybbs (title,author,content) Values (@Title, @Author, @Content)

2 test stored procedures in Query Analyzer:
DECLARE @title char (160)
Declare @author char (20)
Declare @content char (600)
Set @title = ' Test Title 3 '
Set @author = ' David Euler 3 '
Set @content = ' It is the content 3 '
exec insertmybbsproc @title, @author, @content

3 Execute stored procedures through SqlCommand in C #:
SqlConnection coredb=new SqlConnection ();
coredb.connectionstring= "Workstation id=/" gqa-eric-lv/";p acket size=4096;integrated Security=sspi;"
"Data source=/" gqa-eric-lv/";p ersist security info=false;initial catalog=coredb";

String Title=textbox1.text;
String Content=textbox2.text;

if (title.trim () = = "" | | Content.trim () = = "") return;

Insertmybbsproc is the procedure that inserts data into the Mybbs:
SqlCommand insertcmd = new SqlCommand ("Insertmybbsproc", coredb);

The insertcmd.commandtype=commandtype.storedprocedure;//command type is a stored procedure, and the following defines the parameter object:
SqlParameter prm1=new SqlParameter ("@Title", sqldbtype.char,160);
SqlParameter prm2=new SqlParameter ("@Author", sqldbtype.char,20);
SqlParameter prm3=new SqlParameter ("@Content", sqldbtype.ntext,1073741823);
Prm1. Direction=parameterdirection.input;
Prm2. Direction=parameterdirection.input;
Prm3. Direction=parameterdirection.input;
Add SQL parameters for Insertcmd:
INSERTCMD.PARAMETERS.ADD (PRM1);
INSERTCMD.PARAMETERS.ADD (PRM2);
INSERTCMD.PARAMETERS.ADD (PRM3);
assigning values to SQL parameters:
Prm1. Value=title;
Prm2. Value= "David Euler";
Prm3. Value=content;

Coredb.open ();
int Recordsaffected=insertcmd.executenonquery ();
if (recordsaffected==1) Response.Write ("<script>alert (" + "Insert Success" + ");</script>");
Coredb.close ();