title: How to use SQL parameters to get dataset from SQL Server
body: <p>I'm working on C# project and I'm new to this technology.</p>
  
  <p>I want to read some data from SQL Server 2008, and I write the following code</p>
  
  <pre><code>public User select(string username, string password)
  {
      string connection = ConfigurationManager.ConnectionStrings["lawyersDBConnectionString"].ConnectionString.ToString();
      string sql = string.Format("select * from users where userName = '{0}' and password = '{1}'", username, password);
  
      SqlConnection con = new SqlConnection();            
      con.ConnectionString = connection;
  
      DataSet ds = new DataSet();
      SqlDataAdapter da = new SqlDataAdapter(sql, con);            
  
      User user = new User();
      DataRow dr;
  
      try
      {
              da.Fill(ds);
              dr = ds.Tables[0].Rows[0];
  
              user.Id = Convert.ToInt16(dr["userID"]);                
              user.FirstName = (string)dr["firstName"];
              user.LastName = (string)dr["lastName"];
              user.Email = (string)dr["email"];
              user.Username = (string)dr["userName"];
              user.Password = (string)dr["password"];
              user.type = (string)dr["type"];
  
              return user;
      }
      catch (Exception ex)
      {                
              return null;
      }
  }//end of select method
  </code></pre>
  
  <p>But I had read an article about SQL injection, and I want to use SQL parameters to avoid this, but I don't know how. </p>