Access database valid chars?

[Ontani]

hey i'm working on a vb.net project.

everything works fine but for 1 thing.

i connect to my database, try to insert a value and try to get it back later.

this all works except for 1 value.

 

when my value has the chars '][' in it.

 

the value's are all player names and some have '][' for a T.

How can i still put these names in my database and get them back out.

 

i'm currently using:

 

Dim MyCommand As New OleDbCommand("INSERT INTO playerStats (playerName, playerFrags, playerDeaths, playerHeadshots) VALUES ('" & Player & "', '1', '0', '0')", MyConnection)
MyCommand.ExecuteNonQuery()
MyCommand.Dispose()

 

And

 

Dim playerFrags, playerDeaths, playerHeadshots As String
Dim MyCommand As New OleDbCommand("SELECT * FROM playerStats WHERE playerName = '" & Player & "'", MyConnection)
Dim MyReader As OleDbDataReader = MyCommand.ExecuteReader()
While MyReader.Read
  playerFrags = MyReader("playerFrags")
  playerDeaths = MyReader("playerDeaths")
  playerHeadshots = MyReader("playerHeadshots")
End While
MyReader.Close()
MyCommand.Dispose()

 

Greetz

 

PS: i don't want to replace the '][' by a T cause maybe other names have somesort of unvalid chars in it.

[PlausiblyDamp]

Use a parameterised query or a stored proc (if your db supports them) rather than just concatenating strings.

[Ontani]

Thanx For the quick reply

 

bleh, i'm dutch you know :D don't understand it.

[PlausiblyDamp]

http://www.xtremedotnettalk.com/showthread.php?t=87082

http://www.xtremedotnettalk.com/showthread.php?t=72691

 

may be worth a quick read