sql = Replace(sql, "'", "''")