C# 在把变量嵌入SQL中

1、使用 ' " +    + " ' 拼接

string mysql = 
    " SELECT Cname,Grade 
      FROM student,score,course 
      WHERE student.Sno = score.Sno and 
                  score.Cno = course.Cno and 
                  student.Sno = ‘" + Convert.ToString(textBox1.Text) + "’ and         
                  score.Text =‘" + Convert.ToInt32(comboBox1.Text) + “’;
    ”; 

2、使用占位符

string mysql = string.Format(
    "SELECT Cname,Grade 
     FROM student,score,course 
     WHERE student.Sno = score.Sno and 
                score.Cno = course.Cno and 
                student.Sno = '{0}' and 
                score.Text = '{1}' " ,
    textbox1.Text,ComboBox1.Text);    

String str="select zkzh,school,name,n1,fzf from yw01 where aaa= ' "+aaa+ " ' ";//字符串型变量
String str="select zkzh,school,name,n1,fzf from yw01 where aaa="+aaa;//int型变量