Safety from SQL injection

Question

SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings[\"techconn\"].ToString());

            SqlCommand com = new SqlCommand(\"select * from          


        

Answer 1

In short, the answer is no. You need to always use parameters in your queries.

SqlCommand com = new SqlCommand("select * from hs where ac between @ac1 and @ac2 and em=@em", con);

You then add the parameters to your SqlCommand object (com).