SQL Injection Mitigation

        for(i = 0; i != nLen; i++) { //if string is full of blank spaces return false
            if (sString.charAt(i) == "'") {
            sNew = sNew + "''";
            }else{
            sNew = sNew + sString.charAt(i);
            }
        }