This is what happens when you don't use parameterized commands! I know that I've given you code samples before for this. Creating a SQL command by concatenating your params together is arcane and should not be used in .NET. If you use a SqlCommand, for example, then you should add SqlParameters to its SqlCommand.Parameters collection property and use @_paramname_ in your query without quotes. The command will do what's necessary. See the documentation for the SqlParameter (or OleDbParameter, or any of the others) in the .NET Framework SDK. There are also a lot of other benefits to using parameterized commands, such as easy batch processing when you save the parameters as variables and simply update their Value property, then re-execute the command.
Microsoft MVP, Visual C# My Articles