title: Escape single quote in sql query c#
body: <p>Here I have this method in my <code>CandidateOp</code> class file.</p>
  
  <pre><code>public SqlDataReader getpartyID(string partyName)
  {
      string query = "EXEC partyIDtoInsert'" +partyName+ "'";
      return new DataAccessLayer().executeQuerys(query);
  }
  </code></pre>
  
  <p>I'm passing the <code>ComboBox</code> text in the form and I am getting the <code>ID</code> to the integer type variable <code>tempPrID</code>. </p>
  
  <pre><code>SqlDataReader reader02 = new CandidateOP().getpartyID(cmbParty.Text);
  if (reader02.HasRows)
  {
      while (reader02.Read())
      {
           tempPrID = (Int32)reader02[0];
      }
      reader02.Close();
  }
  else
  {
      MessageBox.Show("Please enter a valid Party Name", "Invalid DATA");
  } 
  </code></pre>
  
  <p>The <code>partyIDtoInsert</code>, is a stored procedure I have created and it is being called in the method <code>getpartyID</code> as shown before, to get the id of united national party.</p>
  
  <pre><code>EXEC partyIDtoInsert 'United National Party'; 
  </code></pre>
  
  <p>If I have a party name called "United People's Freedom Alliance", so If I like to  insert that name, my stored procedure executing code it looks like this.</p>
  
  <pre><code>EXEC partyIDtoInsert 'United People's Freedom Alliance';
  </code></pre>
  
  <p>In this case the it considers the end point as People's single quote and returns me with sql exception.  </p>
  
  <p>How to escape this single quote problem in the statement to execute my stored procedure.          </p>