title: Escape single quote in a SQL query string in C#
body: <p>Just assume that I have no control of creating the query string, for example,</p>
  <pre><code>select * from customer where name='Joe's construction'
  </code></pre>
  <p>Also, there isn't any control of executing the query, for example, pass this to a <a href="https://en.wikipedia.org/wiki/Representational_state_transfer" rel="nofollow noreferrer">REST</a> API to execute on a database.</p>
  <p>I need to escape the query as</p>
  <pre><code> select * from customer where name='Joe\'s construction'
  </code></pre>
  <p>So I need to write a function like this:</p>
  <pre><code> string escape(string sql)
  </code></pre>
  <p>The function pass the origin query and return the escaped string, so it can use the function like this:</p>
  <pre><code> string s = &quot;select * from customer where name='Joe's construction'&quot;;
   string es = escape(s);
   // 'es' should equals &quot;select * from customer where name='Joe\'s construction'&quot;
  </code></pre>
  <p>How can I make this function escape work?</p>
  <p>Again, I have <em>no</em> control of creating that SQL query. I am <em>only</em> able to get the query string as a whole piece. And I am not using it to execute on any database; I just need to escape it and pass to an API.</p>