I am using OData to query my database. The following line of code works fine when “adapterName” just contains text.

ds.query('/DataAdapters?$filter=Name eq \'' + adapterName + '\'', ifmgr_CreateAdapter_Step1, onGenericFailure, '');

If “adapterName” contains a single quote it fails. I tried escaping the single quote by using the following code:

adapterName = adapterName.replace(/\'/g, '\\\'');

Although this correctly escapes the user defined text the function still fails. Can anyone tell me what the correct format is for text in the query?

share|improve this question
    
FIXED :) I needed to convert the single quote into a double quote. – Retrocoder Oct 20 '10 at 15:17
    
To note: if you use the substring filter and the query is already within quotes you will need to escape with 4 ' not 2. – chapmatic Mar 4 '16 at 20:23

Actually %27 is not a solution. The correct way to escape is to place two single quotes into the string instead one. In example "o''clock"

share|improve this answer
6  
+1. Replacing ' with \' or %27 does not seem to work with odata query. This should be the accepted answer. – Mathieu Feb 6 '12 at 20:23
1  
I completely agree, %27 gives 400 bad request because of invalid characters in request path. – jwendl Mar 27 '12 at 21:09
    
Peer pressure here, this solution works, %27 throws errors. – rob.alarcon Mar 8 '13 at 23:01
    
Just curious: Would escaping with backslash also be acceptable? Example: "o\'clock" – Torben Rahbek Koch Sep 11 '13 at 15:24
2  
I'm flubbed why this seems to be undocumented in the relevant place(s) odata.org/documentation/overview/#AbstractTypeSystem – sehe Jan 4 '14 at 13:32

I want to expand upon the answer a bit so that it also applies to calling an oData Service Operation Action. The answer posted answer is correct, but there is a specific order in which the parameters to a service operation must encoded.

oData Service Operations receive primitive type parameters where strings are enclosed in a ' such that a valid url (pre encoding) will be as such

AddString?value='o''clock'

This will cause the server to see

AddString?value='o'

and

'clock'

will produce "Bad Request - Error in query syntax."

To correct this, you must double escape the ' and UrlEncode it prior to insertion into the url.

Do not UrlEncode the url itself.

Here's an example that will work.

// value passed as "o'clock"
public async Task AddString(string value)
{
    // Escape ' with '' and UrlEncode value
    value = HttpUtility.UrlEncode(value.Replace("'", "''"));

    string url = String.Format("AddString?value='{0}'", value);

    // No need to UrlEncode url here as dynamic content has already been escaped 

    // Execute .....
}

[WebGet]
public void AddString(string value) 
{
    // here value will be "o'clock"
}
share|improve this answer

When using wit substringof it needs to be escaped by having 4 instead of 1 apostrophe:

a'b -> $filter=(substringof('a''''b', FirstName))

share|improve this answer
    
This is a comment at the answer, not the answer – sehe Jan 4 '14 at 13:31

Instead of using $filter=Title eq 'text'

I am using the oData startswith() function.

$filter=startswith(Title, key)

and then I pass in as much of key as I can.

var pos = key.indexOf("'");
if(pos > -1) {
key = key.substring(0, pos);
}

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.