Is Replacing Quotes Enough to Prevent SQL Injection?

I'm reviewing some old code written by other devs and I stumbled upon the following code on login page:

...
var sql = String.Format("SELECT * FROM Users WHERE Useame = '{0}'", txtUseame.Text.Replace("'", "''"));
var command = new SqlCommand(coection, sql);
...

At first I thought it is vulnerable to SQL Injection, but after some testing I couldn't break it. Is just replacing quotes enough to prevent SQL Injection in this case?

While using quotes can help, you should consider using proper parameterization to take advantage of some of the built-in protection that the .NET framework provides to check that the parameters are of the proper type, etc.

var sql ="SELECT * FROM Users WHERE Useame = @useame";
using(var command = new SqlCommand(coection, sql))
{
     command.Parameters.AddWithValue("@useame",txtUseame.Text);
}

Typically, the best option is to practice the use of parameterized queries. That's a solid first line of defense for SQL Injection.

This blog on the MSDN website will probably be a good read, regarding to your question.

https://blogs.msdn.microsoft.com/sqlphp/2008/09/30/how-and-why-to-use-parameterized-queries/