Question: I have an asp.net project done in C# (my C# syntax is very rusty) and am using the built in database it creates with the project. I've created a table called aspnet\_Tutorials that (for now) stores two columns of user submitted data: TutorialName and TutorialContent. Very simple, it's a learning project. 

What I need to do is create a list from the first column of aspnet\_Tutorials to use it to create a "directory" of the tutorials on a page. The part I'm having trouble with, mostly syntactically, is connecting to and iterating over the column to get the values into a list. Could anyone provide a straight forward example of this? And possibly explain what's going on in the code.

```
public class TutorialsDirDAL
    {
            SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["ApplicationServices"].ConnectionString);
            SqlCommand cmd = new SqlCommand();
            SqlDataAdapter da = new SqlDataAdapter();
            DataSet ds = new DataSet();

        public List<string> DisplayTutorials() //parameters? String qry?
        {
           //query the database table, foreach loop over the data, place it into a list?
        }
    }

```

I know how to write simple sql queries. But I've seen a couple different set ups for this in my Googling spree. I currently have the following for a query, feel free to pick it apart or offer a better solution than using a query.

```
cmd.CommandText = "SELECT * FROM ASPNET_TUTORIALS (TutorialTitle)"
                + "VALUES (@tutorialTitle)";

```

Thank you!

Answer: 
This is not an **mysql\_real\_escape\_string** data but **html\_specialchars()** encoded data 

you can do the reverse with [htmlspecialchars\_decode()](http://www.php.net/manual/en/function.htmlspecialchars-decode.php)
Would recommend not to apply htmlspecialchars when you save the database.
The sanitize should be applied when sending output, if necessary.