MySql Query Escape

[peter]

In MySql things like ' and " ( quotes ) cause query problems as you well know.

In C# Using quotes in the text boxes causes problems allowing SQL injections ect.. Now, in PHP there is something mysql_escape_string(string); but how do you do it in C#?


[qoute]
string username = txtUsername.Text.ToString();
string password = txtPassword.Text.ToString();

sql.command.CommandText = "SELECT * FROM `users` WHERE `username`='" + username + "' AND `password`='" + password + "' LIMIT 1";
[/quote]


Thank You