I am writing an update statement. I think my SQL statement is opening me up for SQL injections.  Is there a better to do this?public void UpdateQuote(string quote, string quote_id){    using (IDbConnection dbConnection = Connection) {    string query = Update quotes set quotes = '+quote+', updated_at = NOW() where id_quotes = '+quote_id+';    dbConnection.Open();    dbConnection.Execute(query, quote);}
Update quote statement
c#;sql
You can parametize a command and execute it.using (IDbConnection dbConnection = Connection){    using (DbCommand cmd = dbConnection.CreateCommand())    {        cmd.CommandType = CommandType.Text;        cmd.CommandText = UPDATE quotes                         + SET quotes = @Quote,                         + updated_at = NOW()                         + WHERE id_quotes = @QuoteID;        IDbDataParameter quoteParam = cmd.CreateParameter();        quoteParam.ParameterName = @Quote;        quoteParam.Value = quote;        cmd.Parameters.Add(quoteParam);        IDbDataParameter quoteIdParam = cmd.CreateParameter();        quoteIdParam.ParameterName = @QuoteID;        quoteIdParam.Value = quote_id;        cmd.Parameters.Add(quoteIdParam);        cmd.ExecuteNonQuery();    }}This isn't the most elegant solution, but should serve your needs.I wasn't sure about your Connection variable, but it should be open at time of execution.