title: SQL query formation dynamically, using string.format
body: <p>I have a serious problem of formatting queries, it may result in SQL injection too, I saw some similar qstns, but not sure how could i use it in C# as I am new to it. I use c#,Odbc command</p>
  
  <p>I have 3 strings like 
  <code>qry ="select description from TableA" , qryOrder = " order by description" , qryAppend = " where ID = '{0}' order by description\", _selectedPlantID"</code>  provided <code>_selectedId</code> is another variable, Now I want to use these variables to form diff queries at different scenarios, for eg, <code>qry + qry order</code> , or <code>qry + qryAppend</code>.</p>
  
  <p>Since <code>_selectedPlantId</code> is also needed, I use string.Format as :</p>
  
  <pre><code>_cmd.CommandText = "string.Format(\"" + qry + qryAppend + ")";
  </code></pre>
  
  <p>But its not working. any solution ?
  Error is SQL syntax error with quotes</p>
  
  <p>thanks in advance !!</p>