Select Problem with s possession

The problem is that you have a value for word which contains a single quote, which is a string delimeter in SQL. Instead of getting into Escape operations in .NET you should instead use a parameterized query. Like this:

string word= "Parent's House";
string str = "select count(*) from table1 where name = @p1";
cnn.Opent();
OleDbCommand cmd = new OleDbCommand(str, cnn);
OleDbCommand.Parameters.AddWithValue("@p1",word);
int x = (int)cmd.ExecuteScalar();
cnn.Close();

That way ADO.NET will take care of shaping the string values so they become valid.

You have identified the problem well and this is the very beginnings of a way of breaking into a website and its data, it is known as SQL Injection ( read this for an example - http://unixwiz.net/techtips/sql-injection.html ) and is (sadly) a very common method of breaking into SQL databases. It is recommended that you use a parameterised stored procedure to execute the SQL needed to fill your web pages. In the s. proc you can do the necessary checks for valid parameter values and not give anything away to someone who might want to break in. Magnus' suggestion of using a parameterised query is also valid providing you follow similar steps to mitigate unwanted attempts to break in.

As an alternative to using parameterised SQL, you could stick with the old-fashioned tried-and-trusted method of running every string value through a search & replace mechanism that replaces a single ' with '' (two 's)