single quotes escape during string insertion into a database

Question

Insertion fails when "'" is used. example string is: He's is a boy. I've attempted to skip the "'" using an escape symbol , but I believe this is not the right way.

textBox3.Text.Replace("'", " \'"); string sql= "insert into gtable (1text,1memo) values ('"+textBox3.Text+"',null)";         OleDbCommand cmd = new OleDbCommand(sql, con);          con.Open();         cmd.ExecuteNonQuery();         con.Close(); 

I did have the option of replacing "'" with "`" but this changes the text in the db as well. I wish to retain "'" as the same , and also insert it into the db.

Answer 1

Try this

    string sql= "insert into gtable (1text,1memo) values (@col1,NULL)";     OleDbCommand cmd = new OleDbCommand(sql, con);     cmd.Parameters.AddWithValue("@col1",textBox3.Text);     con.Open();