I thing that this good practice to use parameters.

Something like that:

string strSql = "UPDATE

SET [A] = @a";

System.Data.SqlClient.SqlCommand command = new System.Data.SqlClient.SqlCommand(strSql,oSqlConnection);

command.CommandType = CommandType.Text;

command.Parameters.Add("@A", SqlDbType.string);

command.Parameters["@A"].Value = strA;

command.ExecuteNonQuery();

is...