title: How to prevent a SQL Injection escaping strings
body: <p>I have some queries (to an acccess database) like this :</p>
  
  <pre><code>string comando = "SELECT * FROM ANAGRAFICA WHERE E_MAIL='" + user + "' AND PASSWORD_AZIENDA='" + password + "'";
  </code></pre>
  
  <p>and I'd like to "escape" user and password, preventing an injection.</p>
  
  <p>How can I do it with C# and .NET 3.5? I'm searching somethings like mysql_escape_string on PHP...</p>