Escape characters like "\" in a string in a sql query

strLocation = strLocation + @"%";

        strLocation =  strLocation.Replace(@"\", @"\\");
       
       
        string query = "SELECT * FROM FileFolder where idUser = "+ UserId + " and Location like '" + strLocation +"' " ;

        query += "ORDER BY IsDirectory DESC, IsDefaultDir DESC, Name ASC";

        try
        {
            Database db = new Database();
            db.Param_CreateCommand(query);
            //db.Param_AddWithValue(@"idUser", UserId);
            //db.Param_AddWithValue(@"Location", strLocation);

            DataSet ds = db.Param_GetDataSet();
            db.Cleanup();
            return ds;
        }
        catch (Exception ex)
        {
            General.ExceptionOccured(ex);
        }

        return null;