Powershell and SQL Strings passed from AD - sql

Question

Okay here is an interesting one. I will try to simplify the issue down
In Powershell, lets say I use the following:
$users = Get-ADUser | Select samAccountName, givenName, sn
Active Directory example has 3 users:
First Name Last Name
__________ _________
Jen Jones
Jason O'Neil
Jake Johnson
I have a SQL Update command within powershell to update a table that looks like so:
ForEach($U in $Users){
$SQLAddInfo = "
UPDATE
Table1
SET
User_Last_Name = '$($User.sn)',
User_First_Name = '$($User.givenName)'
WHERE
User_ID = '$($User.samAccountName)'"
$SqlConnection.Open()
$SqlCmd.CommandText = $SQLaddInfo
$SqlCmd.Connection = $SqlConnection
$SqlCmd.ExecuteNonQuery()
$SqlConnection.Close()
}
Now the problem is that this works most of the time, but when I get to the last name of O'Neil, SQL thinks the apostrophe is a terminator for the SQL command. How do I use variables here and still have Powershell or SQL ignore the apostrophe?

Answer 1

Parameterized queries. Anything else, and O'Neil is far from your only problem.
.... coming back a day later, because I forgot to talk about Table-Valued parameters.
If the Get-ADUser call here produces 1000 results, you're gonna run 1000 SQL queries, and that's not fun. You can do better, by sending all of the data to the server in one step via a table-valued parameter, where you do an INSERT/SELECT that uses that parameter to only run one query.