Using variables in SQL queries in asp.net (C#)

Question

I have an SQL query of this form

string cmdText = \"Select * from \" + searchTable 
  + \"WHERE \" + searchTable 
  + \"Name =\' \" +   searchValue + \"\'\";         


        

Answer 1

string cmdText = "Select * from " + searchTable + " WHERE Name = '" +   searchValue + "'";