1. Delimits the special character with square brackets:
Examples:
for '%' we will write:
SELECT * FROM TableName WHERE ColumnName LIKE '%[%]%'
for the text 'UPDATE [TABLENAME]' , that already contain square brackets, we will delimit the open bracket:
select o.name from ..... where text like '%UPDATE [[]TABLENAME]%'
2. Use a custom escape character:
Examples:
for '%' we will write:
SELECT * FROM TableName WHERE ColumnName LIKE '%\%%' ESCAPE '\'
and for 'UPDATE [TABLENAME]' we will write:
select o.name from ..... where text like '%\UPDATE [TABLENAME]%' ESCAPE '\'
Note: you can protect the code from SQL Injection using ESCAPE:
No comments:
Post a Comment