title: Escape special characters in MySQL using C# and ASP.Net
body: <p>I have a ASP.Net web page with a MySQL back end. The blog content on this site is populated from the MySQL database. When ever I wanted to write a blog entry, I would open MySQL Workbench, right click on the table and select "edit data" and then proceed to type my entry. Well, now I'm working on a C# application that will allow me to write a blog entry so that I don't have to open workbench everytime. Everything so far is working great except for one minor issue: special characters.</p>
  
  <p><strong>==Example==</strong></p>
  
  <p>In textBox1 I will write the following,</p>
  
  <blockquote>
    <p>I can tell you that this won't work because of the apostrophe</p>
  </blockquote>
  
  <p>My code looks like this (may be a little off as I'm writing this from memory, but it does work):</p>
  
  <pre><code>MySQLCommand cmd = new MySQLCommand("",conn);
  cmd.CommandText = "INSERT INTO blogEntry (entryText) VALUE (" + textBox1.text + ");";
  ...
  </code></pre>
  
  <p>This works and the text is inserted into my table. But when I pull it back out and bind it to a DataGridView I see this:</p>
  
  <blockquote>
    <p>I can tell you that this won</p>
  </blockquote>
  
  <p>and that's it (or I see some wierd formatting or something).</p>
  
  <p><strong>==SUMMARY==</strong></p>
  
  <p>I know it has something to do with the apostrophe not being escaped. So my questions are:</p>
  
  <p>1) In C#, is there a way to go through the entire text in textBox1 and replace all special characters (') with escapes (\') so that they show correctly when pulled from the database?</p>
  
  <p>2) I read about some people using stored procedures or parameters in the INSERT statements. Would that work for me and how exactly would I do that (I'm having some trouble finding examples of my specific case)?</p>
  
  <p>Thanks for any help, ideas, links, etc.</p>