The string '{0}' contains a combination of characters (', ", & ;) that cannot not be passed into a SQL Server connection ...