title: False Alarm: SqlCommand, SqlParameter and single quotes
body: <p>I'm trying to fix single quote bug in the code:</p>
  
  <pre><code>std::string Index;
  
  connection-&gt;Open();
  String^ sTableName = gcnew String(TableName.c_str());
  String^ insertstring = String::Format("INSERT INTO {0} (idx, rec, date) VALUES (@idx,    @rec, getdate())", sTableName);
  SqlCommand^ command = gcnew SqlCommand(insertstring, connection);
  String^ idx = gcnew String(Index.c_str());
  command-&gt;Parameters-&gt;Add("@idx", SqlDbType::VarChar)-&gt;Value = idx;
  </code></pre>
  
  <p>The bug is that if idx="that's", the SQL fails saying that there is a syntax error. Obviously, the problem is in the quote. 
  But some googling shows that using parameters is the way to work with quotes. And SqlParameter works well, if type is TEXT and not VARCHAR.</p>
  
  <p>There are any solutions other than manually doubling number of quote symbols in the string?</p>
  
  <p>Update: I tried to manually edit this field in SQL Management Studio and it didn't allow single quotes in VARCHAR field. It this normal in SQL?</p>