I thing that this good practice to use parameters.
Something like that:
string strSql = "UPDATE
SET [A] = @a";
System.Data.SqlClient.SqlCommand command = new System.Data.SqlClient.SqlCommand(strSql,oSqlConnection);
command.CommandType = CommandType.Text;
command.Parameters.Add("@A", SqlDbType.string);
command.Parameters["@A"].Value = strA;
command.ExecuteNonQuery();
is...