对sql inject的简单防范，据说这样其实是不够的，请明白人加以说明

  /// <summary>
  /// Escapes a string to allow it to be safely used in an SQL
  /// query. It will double up single quotes, and return the supplied
  /// string wrapped in single quotes. Eg the string "Steve's a guy"
  /// will be returned as "'Steve''s a guy'". Binary characters are
  /// not handled.
  /// </summary>
  /// <returns>Resulting string</returns>
   public static string Quote( string input)
  {
    return String.Format("'{0}'", input .Replace("'", "''"));
  }