<p>I am coding in ColdFusion, but trying to stay in cfscript, so I have a function that allows me to pass in a query to run it with 
<code>
&lt;cfquery blah >
  #query#
&lt;/cfquery> </code></p>

<p>Somehow though, when I construct my queries with <code>sql = "SELECT * FROM a WHERE b='#c#'"</code>  and pass it in, ColdFusion has replaced the single quotes with 2 single quotes.  so it becomes <code> WHERE b=''c''</code> in the final query.</p>

<p>I have tried creating the strings a lot of different ways, but I cannot get it to leave just one quote.  Even doing a string replace has no effect. </p>

<p>Any idea why this is happening?  It is ruining my hopes of living in cfscript for the duration of this project</p>

ColdFusion, by design, escapes single quotes when interpolating variables within
```
<cfquery>
```
tags.
To do what you want, you need to use the
```
PreserveSingleQuotes()
```
function.
```
```
<cfquery ...>#PreserveSingleQuotes(query)#</cfquery>
```
```
This doesn't address, however, the danger of SQL injection to which you are exposing yourself.
Using
```
<cfqueryparam>
```
also allows your database to cache the query, which in most cases will improve performance.
It might be helpful to read
an old Ben Forta column
and
a recent post by Brad Wood
for more information about the benefits of using
```
<cfqueryparam>
```
.