Currently I learning the asp.net in c#,
I found that if I allow users to input some value in Textbox field,
the (') simbol will cause the sql statement throw error

the good practices to avoid this kind of error is to block the symbol using javascript like "event.keyCode!=222" or replace it by other symbol?