通过C＃在SQL INSERT INTO中转义特殊字符

您应该始终使用参数化查询。它们可帮助您避免遇到类似情况以及SQL
Injection攻击

sqlCom.CommandText = "INSERT INTO dbo.Table(userId, imagePath, userComments, dateCommented) VALUES (@userId, @imagePath, @userComments, @dateCommented)";sqlCom.Parameters.AddWithValue("@userId", userId);sqlCom.Parameters.AddWithValue("@imagePath", imagePath);sqlCom.Parameters.AddWithValue("@userComments", comments);sqlCom.Parameters.AddWithValue("@dateCommented", theDate);