2

I have double quotes in my Keyword. How can I search this in my fulltext search query. I have this query

SELECT  top 10 K.[KEY], 10, K.[RANK]
FROM    CONTAINSTABLE(ProductKeywords, Keywords, '("19*") AND ( "<Cat>5" OR "<Cat>30" OR "<Cat>398" ) AND NOT "<Blocked>"' ) AS k

It works fine but when i have double quotes in my keyword like

SELECT  top 10 K.[KEY], 10, K.[RANK]
FROM    CONTAINSTABLE(ProductKeywords, Keywords, '("19"*") AND ( "<Cat>5" OR "<Cat>30" OR "<Cat>398" ) AND NOT "<Blocked>"' ) AS k

it gives this error

Msg 7630, Level 15, State 3, Line 1
Syntax error near '*' in the full-text search condition '("19"*") AND ( "<Cat>5" OR "<Cat>30" OR "<Cat>398" ) AND NOT "<Blocked>"'.
1

Since the content of 'Keywords' is interpreted by the RDBMS instead of being read literally, your code is vulnerable to SQL Injection . This is also why you get the syntax errors.

You must sanitize the content of 'Keywords'. There's an answer on Stack Overflow : here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.