Merge pull request sqlkata#554 from tskong/sqlinjection-quotes

Escape single quotes for sql injection
TianCaibailei · Feb 13, 2022 · a1f8e3f · a1f8e3f
2 parents 7bf1595 + 77de282
commit a1f8e3f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/QueryBuilder/SqlResult.cs b/QueryBuilder/SqlResult.cs
@@ -81,7 +81,7 @@ private string ChangeToSqlValue(object value)
             }
 
             // fallback to string
-            return "'" + value.ToString() + "'";
+            return "'" + value.ToString().Replace("'","''") + "'";
         }
     }
 }