sybase escape character

Question

I have an update query that updates a column that holds another application SQL query. Putting SQL inside has been problematic I wanted to resolve it with escape characters.

update 
    my_table
 set
   sql_column = 'UPDATE inner_table SET user_name=\'user_name\' text=\'this this free text with things like \" inside it and drives me made\''
 where 
   condition_col = 123456

The above is correct in any SQL syntax checker; however, Sybase throws an error simply Incorrect syntax new 'username.'

I am new to Sybase; please help.

I was expecting that Sybase would behave like MySQL, which is different.

Answer 1

Sybase (and ansi-standard SQL^*) escapes the single quote with itself. You don't need to do anything special with a double quote inside a string literal (since in ansi-standard SQL double quotes do not create literals).

sql_column = 'UPDATE inner_table SET user_name=''user_name'' text=''this this free text with things like \\" inside it ...'

But Sybase will NOT behave like MySQL (it's far more standards compliant).

Lacking some context here, but this kind of code is also likely to end up leaving you dangerously susceptible to SQL injection issues, and that's a really big deal.

---

_{* The link is for Informix, but it does a good job explaining the standard}