Escape single quotes for sql injection

Author: tskong

QueryBuilder/SqlResult.cs

@@ -81,7 +81,7 @@ private string ChangeToSqlValue(object value)
             }
 
             // fallback to string
-            return "'" + value.ToString() + "'";
+            return "'" + value.ToString().Replace("'","''") + "'";
         }
     }
 }