title: How to escape simple SQL queries in C# for SqlServer
body: <p>I use an API that expects a SQL string. I take a user input, escape it and pass it along to the API.  The user input is quite simple. It asks for column values. Like so:</p>
  
  <pre><code>string name = userInput.Value;
  </code></pre>
  
  <p>Then I construct a SQL query:</p>
  
  <pre><code>string sql = string.Format("SELECT * FROM SOME_TABLE WHERE Name = '{0}'",
                             name.replace("'", "''"));
  </code></pre>
  
  <p>Is this safe enough? If it isn't, is there a simple library function that make column values safe:</p>
  
  <pre><code>string sql = string.Format("SELECT * FROM SOME_TABLE WHERE Name = '{0}'",
                             SqlSafeColumnValue(name));
  </code></pre>
  
  <p>The API uses SQLServer as the database. </p>