C# 在把变量嵌入SQL中

1、使用 ‘ " +    + " ‘ 拼接

string mysql =
    "SELECT Cname,Grade
      FROM student,score,course
      WHERE student.Sno = score.Sno and
                  score.Cno = course.Cno and
                  student.Sno = ‘" + Convert.ToString(textBox1.Text) + "’ and
                  score.Text =‘" + Convert.ToInt32(comboBox1.Text) + “’;
    ”; 

2、使用占位符

string mysql = string.Format(
    "SELECT Cname,Grade
     FROM student,score,course
     WHERE student.Sno = score.Sno and
                score.Cno = course.Cno and
                student.Sno = ‘{0}‘ and
                score.Text = ‘{1}‘ " ,
    textbox1.Text,ComboBox1.Text);