c# - Where to/ how to put the value in for a place holder, in a sSQL statement -

i have ssql statement want select values database, based on selected value of drop down list. here code.

string ssql = "";          ssql = ("select * tbl_tripprefixdestination country {0}", ddlcountryselect.selecteditem.text);         ssql += "";         ssql += "";          openconnection(conn);         datatable dt = new datatable();         sqlcommand cmd = new sqlcommand(ssql, conn); 

to me seems right way this, yet still errors. can please me? ( dont mind

at simplest level need:

ssql = string.format("select * tbl_tripprefixdestination country '%{0}%'", ddlcountryselect.selecteditem.text);  

if you're doing wild card search or

ssql = string.format("select * tbl_tripprefixdestination country = '{0}'", ddlcountryselect.selecteditem.text);  

for exact match.

but should @ sqlparameter object:

ssql = "select * tbl_tripprefixdestination country = @country"; ... sqlparameter param = new sqlparameter("@country", ddlcountryselect.selecteditem.text); sqlcommand cmd = new sqlcommand(ssql, conn); cmd.parameters.add(param); 

as paulg says, 1 (big) reason using sqlparameter database automatically escape data preventing injection attacks - , improved performance. http://blog.codinghorror.com/give-me-parameterized-sql-or-give-me-death/