Ok, I'm trying to write a query in a stored procedure in SQL Server 2000. Because some of the parts of the query vary based on certain situations I construct a string that contains the query and ...

If the user enters data with an apostrophe into a text box, and you attempt to build and SQL string to execute, you get something like this in your string:<BR><BR><B>INSERT INTO MyTable ...