We Keep Coding

Finding a specific single quote and replacing with double quotes in C#

I've a problem where I want to replace some specific single quotes with double quotes inside a SQL string but not all singles quotes in that string.
EXEC procedureName 'param'eter1', 'parameter2'
In above example I just want to replace the singles quotes inside the 'param'eter1' but the singles quotes in start and end of the parameter to remain same.
Using below command replace all singles quotes in the string and it looks like this ''param''eter1'' which is not correct.
sometext.Replace("'", "''")
I want it to look like this:
EXEC procedureName 'param''eter1', 'parameter2'
Also please note that I am already aware that using SqlParameter is a better solution to handle the single quotes in SQL parameters but due to the restrictions in the project environment I am unable to implement that.
Update:
Changing the individual parameters before using them to construct the full statement is not an option for me as I don't have access to that code. My project works like a data layer where it received SQL strings from other applications to process.

This is a very bad idea. The SQL syntax requires you to escape single quotes in literals exactly because it can otherwise not tell whether the single quote is meant to represent a single quote or meant to terminate the string literal.
Consider the following example:
EXEC procedureName 'param ', ' eter1', 'parameter2'
How would you know whether this is meant to have three parameters for the procedure call or only two? And even if you knew that this specific procedure takes two parameters, you couldn't decide whether the middle part belongs to the first or second parameter.
If the system constructs sql statements from user input without dealing with single quotes before the full statement is constructed, this can be used very easily to attack the system via an sql injection.

you can do like this
var aStringBuilder = new StringBuilder(theString);
aStringBuilder.Remove(3, 2); // just find a position of single quotes
aStringBuilder.Insert(3, "/""); // replace that position with " quotes using loop
theString = aStringBuilder.ToString();

How to extract single quote from SQL into an .XSD in C#?

I'm trying to store Regex values in the DB, later to be used for custom validation.
I'm storing a Regex like this:
[a-zA-Z\''\"]+
(Two single qoutes in order to get one in the DB):
[a-zA-Z\'\"]+
When i extract this regex, I get an error while Filling the dataset:
Incorrect syntax near '\'. Unclosed quotation mark after the character string ']+''.
UPDATE #TEMP2 SET CandidateNameRegex='[a-zA-Z\'\"]+'
I've tried different variations:
'[a-zA-Z\''\"]+'
'[a-zA-Z\''\""]+'
'[a-zA-Z\''\\"]+'
'#[a-zA-Z\''\"]+'
'[a-zA-Z\'\"]+'
But none seem to do the trick.
So, How do we extract single quote from the DB without breaking the string?

Unrecognized escape sequence when using a path as a SQL parameter

I am trying to store a string or nvarchar(500) in SQL. When I pass a full file path as a string parameter, there is an error unrecognized escape sequence.
Since path is not an usual param that this stored procedure expects, how can I open this possibility so it can accept string such as c:\foldername\subfoldername. Am I suppose to add # at the begging of a string or use a StringBuilder?
Thanks

Since backslash is considered as a special character(escape), it's causing the issue. Use / or \\ in the path as:
c:/foldername/subfoldername
c:\\foldername\\subfoldername
OR as you said, use # in the front as :
#"c:\foldername\subfoldername"
EDIT: For Javascript, I will simply replace the \ to / as below:
path = path.split("\\").join("/");

You can also escape the backslash() by adding the # to the front of the string for example
#"This\Is\Some\Path"

Replace all single quotes with two single quotes in a string

I am trying to read value from DB using c#.
The query string contains multiple single quotes - such as: Esca'pes' (the query strings are being read from a text file)
So, I wanted to replace all the single quotes with two single quotes before forming the SQL query. My code is as below:
if (name.Contains('\''))
{
name = name.Replace('\'','\''');
}
How to fix this?

Use strings, not char literals.
name = name.Replace("'", "''");
However it sounds like you're concatenating SQL strings together. This is a huge "DO NOT" rule in modern application design because of the risk of SQL injection. Please use SQL parameters instead. Every modern DBMS platform supports them, including ADO.NET with SQL Server and MySQL, even Access supports them.

name = name.Replace("'","''");
On an unrelated note, you're concatenating strings for use in SQL? Try parameters instead, that's what they're meant for. You're probably making it harder than it needs to be.

Since you want to replace a single character with two characters, you need to use the String overload of Replace
if (name.Contains('\''))
{
name = name.Replace("'","''");
}
(Note: single quotes don't require escaping in Strings like they do in character notation.)

How to avoid double quote escape in C# strings?

In Ruby it's possible to use the strings without the need to escape the double quote in the string, like Q/Some my string with "double quotes"/
Is it possible with C# to use a string without a need to escape double quotes?
For a good reason I need to write inline SQL and it's very annoying to escape double quotes every time I put SQL query from DB console to C# code.
I know it's possible to use \" or "" as one double quote. But is it possible to avoid the need to escape the double quotes?

No, basically. You have the choice of "foo \" bar" or #"foo "" bar", both of which you have mentioned. However, frankly I rarely find " necessary in SQL; you have ' for literal strings and [ / ] for object/column names - of course, this might just be because I usually use SQL Server.
The only alternative that doesn't involve any escaping is to move the SQL to an external resource file, maybe a text file. That, though, is probably more painful than just using "".

No, this is not possible in C#. You could write your SQL in a separate file and then read it from there.

For a good reason I need to write inline SQL and it's very annoying to
escape double quotes every time I put SQL query from DB console to C#
code.
If you are writing a Inline Sql Query you don't need to worry about quotes if you passed the values via SqlParameters. This way you won't see the annoying double quotes every where and even your query will safe from Sql Injection