title: Help Regarding SQL injection
body: <p>Please help me to prevent my data from SQL injection.
  I have replaced ' with '' (single quote with 2 quote) while doing any operation on sql server.
  Please tell me what all i need to do , to prevent my application from SQL injection. my application is in asp.net 2.0</p>
  
  <p>i will use parameterized queries but what about my old projects.. i mean what about where i have written a string query and sending it to sql server as a commandtext.</p>
  
  <p>Please tell me can any one insert sql injection even i have replaced ' with ''?</p>