@@ -31,7 +31,7 @@ internal static List<SqlCommand> CreateTable(
3131 if ( ifNotExists )
3232 {
3333 sb . Append ( "IF OBJECT_ID(N'" ) ;
34- sb . AppendTableName ( schema , tableName ) ;
34+ sb . AppendTableNameInsideLiteral ( schema , tableName ) ;
3535 sb . AppendLine ( "', N'U') IS NULL" ) ;
3636 }
3737 sb . AppendLine ( "BEGIN" ) ;
@@ -125,22 +125,22 @@ internal static List<SqlCommand> CreateTable(
125125 // Full-text indexes require a unique index (we use the primary key)
126126 sb . AppendLine ( "DECLARE @pkIndexName NVARCHAR(128);" ) ;
127127 sb . Append ( "SELECT @pkIndexName = name FROM sys.indexes WHERE object_id = OBJECT_ID(N'" ) ;
128- sb . AppendTableName ( schema , tableName ) ;
128+ sb . AppendTableNameInsideLiteral ( schema , tableName ) ;
129129 sb . AppendLine ( "') AND is_primary_key = 1;" ) ;
130130
131131 sb . AppendLine ( "DECLARE @ftSql NVARCHAR(MAX);" ) ;
132132 sb . Append ( "SET @ftSql = N'CREATE FULLTEXT INDEX ON " ) ;
133- sb . AppendTableName ( schema , tableName ) . Append ( " (" ) ;
133+ sb . AppendTableNameInsideLiteral ( schema , tableName ) . Append ( " (" ) ;
134134 for ( int i = 0 ; i < fullTextProperties . Count ; i ++ )
135135 {
136- sb . AppendIdentifier ( fullTextProperties [ i ] . StorageName ) ;
136+ sb . AppendIdentifierInsideLiteral ( fullTextProperties [ i ] . StorageName ) ;
137137 if ( i < fullTextProperties . Count - 1 )
138138 {
139139 sb . Append ( ',' ) ;
140140 }
141141 }
142142 sb . Append ( ") KEY INDEX ' + QUOTENAME(@pkIndexName) + N' ON " ) ;
143- sb . AppendIdentifier ( catalogName ) . AppendLine ( "';" ) ;
143+ sb . AppendIdentifierInsideLiteral ( catalogName ) . AppendLine ( "';" ) ;
144144 sb . AppendLine ( "EXEC sp_executesql @ftSql;" ) ;
145145 }
146146
@@ -897,6 +897,30 @@ internal static StringBuilder AppendIdentifier(this StringBuilder sb, string ide
897897 return sb ;
898898 }
899899
900+ /// <summary>
901+ /// Same as <see cref="AppendTableName"/>, but for use inside a SQL string literal (N'...'),
902+ /// where single quotes must be escaped by doubling them.
903+ /// </summary>
904+ internal static StringBuilder AppendTableNameInsideLiteral ( this StringBuilder sb , string ? schema , string tableName )
905+ {
906+ int start = sb . Length ;
907+ sb . AppendTableName ( schema , tableName ) ;
908+ sb . Replace ( "'" , "''" , start , sb . Length - start ) ;
909+ return sb ;
910+ }
911+
912+ /// <summary>
913+ /// Same as <see cref="AppendIdentifier"/>, but for use inside a SQL string literal (N'...'),
914+ /// where single quotes must be escaped by doubling them.
915+ /// </summary>
916+ internal static StringBuilder AppendIdentifierInsideLiteral ( this StringBuilder sb , string identifier )
917+ {
918+ int start = sb . Length ;
919+ sb . AppendIdentifier ( identifier ) ;
920+ sb . Replace ( "'" , "''" , start , sb . Length - start ) ;
921+ return sb ;
922+ }
923+
900924 private static StringBuilder AppendIdentifiers ( this StringBuilder sb ,
901925 IEnumerable < PropertyModel > properties ,
902926 string ? prefix = null ,
0 commit comments