String manipulations with SQL

[news.microsoft.com]

What is the best way to avoid string manipulations with SQL?

I have edit box control where database is opened for attacks through SQL
commands.

Something like this:
selectString = "SELECT FIRSTNAME, LASTNAME FROM xxxTable WHERE
FIRSTNAME='"+txtTextBox1.Text"'";

Furthermore I would like to avoid of using some characters like ;:,. etc.

If you know for some example I appreciate it. Thanks in advance...

 

[Michael C#]

Use Parameterized Queries to avoid SQL Injection attacks.

 

[PFD]

Here's a great article to help avoid SQL attacks:

http://msdn.microsoft.com/msdnmag/issues/04/09/SQLInjection/default.aspx

Good luck!
PFD