Using variables in SQL queries in asp.net (C#)

Question

I have an SQL query of this form

string cmdText = \"Select * from \" + searchTable 
  + \"WHERE \" + searchTable 
  + \"Name =\' \" +   searchValue + \"\'\";         


        

Answer 1

There is a blank missing and one too much:

searchTable + "Name =' "

should read

searchTable + " Name ='"

Beside that, use SQL parameters to prevent SQL injection.