How to handle apostrophe ( ' ) in XMl and SQL Server - sql-server

Question

I have an XML file which has details of employees and the problem I am try to figure it out is these XML values have apostrophe ( ' ) in random places all over the XML content, so it's getting hard to insert them into SQL Server tables.
I will be sending this entire XML content from MVC C# to a SQL Server stored procedure which will insert the data into various tables, but whenever there is an apostrophe ( ' ) in XML content, the error occurs. So these apostrophes should be either handled or replaced or removed. How can I do this?
This is some sample XML content:
<xml>
<Channel>
<Program id="1" category="A">
<name>Pra'Matino</name>
<Bin>
<Date>1/1/2020</Date>
<Date>1/1/2020</Date>
</Bin>
<Player>
<Pla>S'Rajesh</Pla>
<Pla>Su'man</Pla>
</Player>
<Television>
<HostDeails>2/9/2020</HostDeails>
<HostDeails>MALE</HostDeails>
<HostDeails>Colour</HostDeails>
</Television>
<addresses>
<address>
<address1>No 10</address1>
<city>Chennai</city>
<country>IN's</country>
<ProductName>Lavender's</ProductName>
</address>
<address>
<address1>N0 72</address1>
<city>Sanagoor Road</city>
<postalCode>641006</postalCode>
</address>
<address>
<address1>Old No 10/ New No 3</address1>
<city>Madurai</city>
<country>IN</country>
<ProductName>Lavender</ProductName>
</address>
<address>
<address1>N0 98</address1>
<city>BridhSanagoor Road</city>
<country>SriLanka</country>
<postalCode>641006</postalCode>
</address>
</addresses>
</Program>
<Program id="25" category="B">
<name>Rahman'G</name>
<Bin>
<Date>10/1/2020</Date>
<Date>1/12/1989</Date>
</Bin>
<Player>
<Pla>Paul'D</Pla>
<Pla>Right'F</Pla>
</Player>
<Television>
<HostDeails>5/7/2021</HostDeails>
<HostDeails>MALE</HostDeails>
<HostDeails>C'olour</HostDeails>
</Television>
<addresses>
<address>
<address1>S7</address1>
<city>Coimbatire</city>
<country>IN</country>
<ProductName>Lavender</ProductName>
</address>
<address>
<address1>Sai Akshya Appartment</address1>
<city>Sanagoor Road</city>
<postalCode>631009</postalCode>
</address>
<address>
<address1> No 3</address1>
<city>Thenkaasi</city>
<ProductName>Lavender</ProductName>
</address>
<address>
<address1>N0 98</address1>
<city>Bridh'Sanagoor Road</city>
<country>SriLanka</country>
<postalCode>641006</postalCode>
</address>
</addresses>
</Program>
</Channel>
</xml>
Thank you all.
Copied from comment:
I doing like this
SqlCommand.Parameters.Add("#XMLValue", SqlDbType.Xml).Value = xmlDetails.ToString();

Answer 1

If you use Parameterized Queries (Take a look at SqlParameters), you won't be having these issues.
SqlCommand cmd = new SqlCommand(query, connection);
SqlParameter param = new SqlParameter();
param.ParameterName = "#ParamName";
param.Value = valueVariable;
try not to use string concatenation and be aware of the risks and the implications.
EDIT:
xmlDetails.ToString() dont convert xmlDetails to string. Instead parse it
SqlXml newXml = new SqlXml(new XmlTextReader("MyTestStoreData.xml"));
SqlXml newXml = new SqlXml(xmlDetails); <-- xmlDetails is needed to be either Stream or XmlReader type