Don't concatenate strings to build your command.
For example, if your code is:
MySqlCommand cmd = new MySqlCommand("INSERT INTO myTable (myColumn) VALUES('" + myTextBox.Text + "')", con);
and your text box contains
It's cold today
The the command as seen by SQL is:
INSERT INTO myTable (myColumn) VALUES('It's cold today')which will cause an error becasue it assumes the
'It'
is the value to insert in the myColumn field, and
s cold today'
is a further part of the actual command.
Instead, use parametrised queries:
MySqlCommand cmd = new MySqlCommand("INSERT INTO myTable (myColumn) VALUES(@MC)", con);
cmd.Parameters.AddWithValue("@MC", myTextBox.Text);Using this also protects you from accidental or deliberate SQL Injection attacks, which can damage or destroy your database.