asp.net - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' -

i trying insert html pages mysql asp.net project getting error;

 have error in sql syntax; check manual corresponds mysql server version right syntax use near 'de osman patlaması', '', '<div style=\"text-align: center\">\r\n<img src=\"/i' @ line 1 

how can fix problem server side code is;

mysqlconnection mycon = new mysqlconnection(); mycon.connectionstring = configurationmanager.connectionstrings["mysqlconnectionstring"].connectionstring; mysqlcommand cmd = new mysqlcommand(); cmd.commandtype = commandtype.text;  string query = @"insert `test`.`posts` (`id`, `author`, `title`, `description`, `content`, `ispublished`, `iscommentsenabled`, `pubdate`, `lastmodified`, `raters`, `rating`, `slug`, `tags`, `categories`) values (null, '{0}', '{1}', '{2}', '{3}', '{4}', '{5}', '{6}', '{7}', '{8}', '{9}', '{10}', '{11}', '{12}')"; query = string.format(query, p.author, p.title, p.description, p.content, p.ispublished, p.iscommentsenabled, p.pubdate, p.lastmodified, p.raters, p.rating, p.slug, p.tags, p.categories);  cmd.commandtext = query; cmd.connection = mycon; cmd.connection.open(); cmd.executenonquery(); cmd.connection.close(); 

thanks help.

    mysqlconnection mycon = new mysqlconnection();     mycon.connectionstring = configurationmanager.connectionstrings["mysqlconnectionstring"].connectionstring;     mysqlcommand cmd = new mysqlcommand(@"insert posts (id,  author ,  title ,  description ,  content ,  ispublished ,  iscommentsenabled ,  pubdate      ,  lastmodified ,  raters ,  rating ,  slug ,  tags ,  categories )          values (@id ,@author ,@title ,@description ,@content ,@ispublished ,@iscommentsenabled ,@pubdate ,@lastmodified ,@raters ,@rating ,@slug ,@tags ,         @categories ))", mycon);     cmd.commandtype = commandtype.text;      cmd.parameters.addwithvalue("@id", null);     cmd.parameters.addwithvalue("@author", p.author);     cmd.parameters.addwithvalue("@title", p.title);     cmd.parameters.addwithvalue("@description", p.description);     cmd.parameters.addwithvalue("@content", p.content);     cmd.parameters.addwithvalue("@ispublished", p.ispublished);     cmd.parameters.addwithvalue("@iscommentsenabled", p.iscommentsenabled);     cmd.parameters.addwithvalue("@pubdate", p.pubdate);     cmd.parameters.addwithvalue("@lastmodified", p.lastmodified);     cmd.parameters.addwithvalue("@raters", p.raters);     cmd.parameters.addwithvalue("@rating", p.rating);     cmd.parameters.addwithvalue("@slug", p.slug);     cmd.parameters.addwithvalue("@tags", p.tags);     cmd.parameters.addwithvalue("@categories", p.categories);     mycon.open();     cmd.prepare();     cmd.executenonquery();     mycon.close(); 

use mysqlcommand.parameters.add add parameters. auto escapes , validates parameters.