insert into syntax error while using a variable containing quotes

[Grant Andrews]

I an adding data into an access table via c# and have run into a roadblock. The syntax is

addSQL = "INSERT INTO history ([id], [partner], [from], [msgdate], [msgtime], [message]) VALUES ('" + thisid + "','" + chat.DialogPartner + "','" + chatmessage.FromHandle + "','" + chatmessage.Timestamp.Date + "','" + chatmessage.Timestamp.TimeOfDay + "','" + chatmessage.Body + "')";

The problem relates to the last item, chatmessage.Bod y, which can contain anything a person can type, including single and double quotes. So how do I get the contents of that variable inserted into an access table?

[Rabbit]

Escape the quotes before appending them to the string.

[Mihail]

...or double any quote in chatmessage.Bod y
If chatmessage.Bod y is abcd"efgh"ijc then transform this in abcd""efgh""ijc.

[NeoPa]

Try :

string strBody;
strBody = (string)chatmessage.Body
strBody = strBody.Replace("'", "''");
addSQL = "INSERT INTO history " +
         "([id], [partner], [from], [msgdate], [msgtime], [message]) " +
         "VALUES ('" + thisid + "','" + chat.DialogPartner + "','" + 
         chatmessage.FromHandle + "','" + chatmessage.Timestamp.Date + 
         "','" + chatmessage.Timestamp.TimeOfDay + "','" + strBody + "')";

PS. If I got some of the syntax wrong then I'm sure you can fix it. I've not done too much C# code.