title: Handling special character input for data selection
body: <p><strong>UPDATE</strong></p>
  
  <p>Following four characters need to be escaped when '\' is the escape helper    <code>%[]_</code></p>
  
  <ol>
  <li><a href="http://msdn.microsoft.com/en-us/library/aa933232(v=sql.80).aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/aa933232(v=sql.80).aspx</a>  - LIKE</li>
  <li><a href="https://stackoverflow.com/questions/258757/escape-a-string-in-sql-server-so-that-it-is-safe-to-use-in-like-expression">Escape a string in SQL Server so that it is safe to use in LIKE expression</a></li>
  <li><a href="https://stackoverflow.com/questions/2300285/how-do-i-escape-in-sql-server">How do I escape _ in SQL Server?</a></li>
  </ol>
  
  <p><strong>QUESTION</strong></p>
  
  <p>Though I searched a lot, I could not find out a problem exactly matching the following,  in stack overflow.</p>
  
  <p>I have a database column called Log_Description. It has two records.</p>
  
  <p>1) "Sample % value record"</p>
  
  <p>2) "Sample free record"</p>
  
  <p>I am using SQL Command  and setting parameters as shown below</p>
  
  <pre><code>commandText = commandText + “Log_Description LIKE @Log_Description”;
  command.Parameters.AddwithValue(“@Log_Description”, “%”+obj. LogDescription+”%”); 
  </code></pre>
  
  <p>Suppose the user enters “%” as search param for txtLogDescription textbox, I need to show only first record. But currently it is showing both the records. </p>
  
  <ol>
  <li>What are the possible ways to overcome this?</li>
  <li>What are the other characters that may cause such issues with the above code?</li>
  </ol>
  
  <p>Note: I cannot prevent user from entering “%” as input</p>
  
  <p>Note: I am using SQL Server as database</p>
  
  <p><strong>EDIT</strong>: </p>
  
  <p>Solution I am using now is <a href="https://stackoverflow.com/questions/13861004/escaping-the-escape-character-does-not-work-sql-like-operator">Escaping the escape character does not work – SQL LIKE Operator</a></p>
  
  <pre><code>    private static string CustomFormat(string input)
      {
          input = input.Replace(@"\", @"\\");
          input = input.Replace(@"%", @"\%");
          input = input.Replace(@"[", @"\[");
          input = input.Replace(@"]", @"\]");
          input = input.Replace(@"_", @"\_");
          return input;
      }
  </code></pre>
  
  <p><strong>LINQ</strong> approach (with performance hit) is below</p>
  
  <pre><code>        Collection&lt;Log&gt; resultLogs = null;
  
  
          if (!String.IsNullOrEmpty(logSearch.LogDescription))
          {
              resultLogs = new Collection&lt;Log&gt;();
              var results = from o in logs where o.LogDescription.Contains(logSearch.LogDescription) select o;
              if (results != null)
              {
                  foreach (var log in results)
                  {
                      resultLogs.Add((Log) log);
                  }
              }
          }
          else
          {
              resultLogs = logs;
          }
  </code></pre>