How to make SQL query text parameter accept sentence containing an apostrophe

Question

How I am performing a SQL query to insert data into the database. Note that the field PlanDetails in the table dbo.Plans is a text field. However, when a user tries to input a sentence which contains an apostrophe (e.g. I'll go to sleep). via the HTML form . The database returns an error "Incorect syntax near ll), which refers to the apostrophe problem. In this case, how should I modify the code below to make it accept sentences with apostrophe? It is told that I can use parameterized queries. In this node js example, how can I do that?

CreatePlan : function (newPlan , UserID, DisplayName, Email, callback) {
    var sql = require('mssql');
    var config = require('./configuration/sqlconfig');
    var conn = new sql.Connection(config);
    var req = new sql.Request(conn);
    conn.connect(function (err) {
        if (err) {
            console.log(err);
            return;
        } 
        console.log('Attempting to Insert new learning plan...');
        req.query('INSERT INTO dbo.Plans (PlanTitle, PlanTopic, OwnerID, OwnerName, PlanDetails, TargetLearners, OwnerContact) VALUES ("' + newPlan.PlanTitle + '", "' + newPlan.PlanTopic + '", "' + UserID + '", "' + DisplayName + '", "' + newPlan.PlanDetails + '", "' + newPlan.TargetLearners + '", "' +Email+ '");', function (err) {
            if (err) {
                console.log(err);
            } else {
                console.log("Added one new learning plan");
                console.log("The new plan title is " + newPlan.PlanTitle);
                callback();
            }
            conn.close();
        });
    });
},

Answer 1

In SQL (and in many other languages), you have to escape special characters to avoid any ambiguity in the code. There is a lot of documentation about how to escape and which character are concerned all other internet.

Here is the wikipedia article about escape character: https://en.wikipedia.org/wiki/Escape_character

Here is a stackoverflow post that answer your question: How do I escape special characters in MySQL?

However I should warn you about SQL injection, the code you are using will not be safe and you should probably take a look at the good practice in this matter.