Best way to escape strings for sql inserts?

Question

What is the best way to escape strings for sql inserts, updates?

I want to allow special characters including ' and ". Is the best way to search and replace each string before I use it in an insert statement?

Thanks

Duplicate of: Best way to defend against mysql injection and cross site scripting

Answer 1

You should be using parameterized queries (so by extension, a DB interface library that supports parameterized queries) so that SQL injection can't happen.