VB.NET Function to avoid sql server injection

SUBMITTED BY: fairuzzbdy

DATE: June 17, 2016, 8:46 a.m.

FORMAT: Text only

SIZE: 560 Bytes

Raw Download

HITS: 5558

Report

Public Function strIns(ByVal varvalue As String) As String
        Dim objreplace As String
        If varvalue = "" Or varvalue Is Nothing Then
            objreplace = "' '"
        Else
            If varvalue = String.Empty Then
                objreplace = "' '"
            Else
                Dim newstr As String = varvalue.Replace("'", "''")
                varvalue = Nothing
                objreplace = "N'" & newstr & "'"
                newstr = Nothing
            End If
        End If
        Return objreplace
    End Function