When you insert values into textboxes dynamically, you have to remember the same rules that hold true for basic HTML. When you use a string, you must store it within quotes to prevent premature concatenation. :-)
Becomes:
One thing you want to be careful of is embedded quotes. You might try using ' or " as the delimiter, and eliminating the other for possible entry (using client-side validation of course; the value is destroyed before you'd be able to validate for it on the server side). If you have to allow both ' and ", you could consider using the rarely used "back-apostrophe" (`). You can also try to user Server.HTMLEncode() on the value, before slipping it into the HTML element.
If you do this:
| <... value='<%="foo's bar"%>'> |
This evaluates to:
And everything after 'foo' is ignored, because the browser interprets that as the end of the string.