title: escape characters in SQL query string produced via string.format
body: <p>I have the statement  in c# :</p>
  
  <pre><code>String sql = String.Format("UPDATE Table SET FIRST_NAME='{0}',LAST_NAME='{1}',BIRTH_DATE='{2}' where CUSTOMER_NUMBER ='{3}'",FirstName, LastName,DateOfBirth,Number);
  </code></pre>
  
  <p>The above statement doesn't execute if the first name,last name etc have apostrophe like O'Hare,O'Callahagan because of this the update statement gets the wrong syntax.</p>
  
  <p>How to escape the apostrophe in string.format?</p>