7

I have the following string which won't compile:

String formLookupPull = @"SELECT value1, '"+tableName+"', '"+columnName+"' FROM lkpLookups WHERE ""table"" = '" + tableName + "' and ""field"" = '" + columnName + "';";

The offending sections are :

""table"" =

and

""field"" = 

The compiler is getting all mixed up on the escape sequence. Can anyone see what's wrong?

1
  • thanks for the speedy replies! Commented Mar 16, 2009 at 22:24

7 Answers 7

17

To address your title question...

To escape the quote in a verbatim string literal, use the quote-escape-sequence "" (that's two quote characters)

string a = @"He said ""Hi!""..."; // He said "Hi!"...

See MSDN for more details on escaping, etc.

Note that in your posted code, the only verbatim string is the very first one (with the @ before it). The subsequent strings are not verbatim, so the proper escape sequence would be \".

You can make it look prettier with string.Format:

String formLookupPull = 
   string.Format(@"SELECT value1, '{0}', '{1}' FROM lkpLookups" +
                 @"WHERE ""table"" = '{0}' and ""field"" = '{1}';", 
                 tableName, columnName)
6

The problem is that not all the strings you are concatenating are verbatim string literals, only the first portion of the concatenation is.

In other words,

@"SELECT value1, '"

is the only verbatim literal in the entire statement to build the final string.

You would need to add @ in front of the rest of your strings to make them all verbatim.

Which would make it look like:

String formLookupPull = @"SELECT value1, '"+tableName+ @"', '"+columnName+ @"' FROM lkpLookups WHERE ""table"" = '" + tableName + @"' and ""field"" = '" + columnName + @"';";
4

Well after your first end of quote, the @ symbol is no longer being used anyways so you are free to use the escape character. Try putting your "table" wrapped in '[' like [table] and [field] or escaping the " character with a \.

String formLookupPull = @"SELECT value1, '" + tableName + "', '" + columnName + "' FROM lkpLookups WHERE [table] = '" + tableName + "' and [field] = '" + columnName + "';";
4

If you cannot use SQL Parameters, String.Format can be little cleaner and readable than pure "+ concatenation".

string formLookupPull = 
  string.Format(@"SELECT value1, '{0}', '{1}' 
                       FROM lkpLookups 
                   WHERE ""table"" = '{0}' AND ""field"" = '{1}';",
                tableName, columnName);
1
  • This may be one such case...I'm using a library which doesn't expose any of that stuff to me and i'm trying to stick to it as much as possible because it comes with a few side effects that i'd have to reproduce otherwise... Commented Mar 16, 2009 at 23:42
4

You want to use \" to escape quotes, not "".

Like this:

.. FROM lkpLookups WHERE \"table\" = '" ..

Edit:

Further explanation:

You only have an @ on the first of all the strings you're concatenating. In literal strings (with an @ in front) you escape quotes with a double quote. In normal strings, it's slash-quote.

Eg.

string s = @"this is a literal string with ""quotes"" in it, " 
         +  "and this is a normal string with \"quotes\" in it";

string t = @"two literal strings" + @", concatenated together.";
3
  • Verbatim string literals don't use \ as an escape character, the only escape sequence is "", which is what's being used. The problem is that the verbatim string identifier, @, is only being applied to the first string, not the ones being appended with +.
    – Whatsit
    Commented Mar 16, 2009 at 22:17
  • The problem is that he is using the wrong escape sequence for his string type. He can either change the string to literal (as you say), or change the escape sequence (as I said)
    – Blorgbeard
    Commented Mar 16, 2009 at 22:19
  • Agreed, but your original answer implied that "" was incorrect in the general sense, so it was likely to confuse someone who isn't too familiar with verbatim string literals. Your revised answer is much clearer.
    – Whatsit
    Commented Mar 16, 2009 at 22:25
1
String formLookupPull = @"SELECT value1, '"+tableName+"', '"+columnName+"' FROM lkpLookups WHERE \"table\" = '" + tableName + "' and \"field\" = '" + columnName + "';";

I also trust that you are escaping these variables correctly before building this query :)

1
  • lol yea let's hope so, i was given a DLL with all the functions for performing DB IO inside of it... I'm pretty sure it does proper SQL escaping but I didnt really look to closely... Commented Mar 16, 2009 at 22:24
1

Why are you quoting the literal names of the columns, seem unnecessary to me.

"SELECT value1, " + tableName + "," + columnName +" FROM lkpLookups WHERE table = '" + tableName + "' and field = '" = columnName + "';";

Not tested but I think you will get the idea.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.