On my SQL server I have a very simple table for testing, which only contains three rows: ID, Date and Hours.(varchar,
ID
Date
Hours
varchar
You're preparing a perfect ground for SQL injections. Also look here. There's an example of parametrized query.