Deleting records from a table, is this correct?

Question

Hi! to every One!

I want to delete some record from table ,by running this Query in C# is it Correct or not,

Please help me

SqlCommand cmdRe = new SqlCommand("insert into msisdn_master SELECT *  from tblDeactive
where msisdn in (" + str_MSISDN + ")", cn);
SqlCommand cmdRed = new SqlCommand("delete from tblDeactive where msisdn in ("+str_MSISDN+")", cn);
cmdRe.CommandType = CommandType.Text;
cmdRed.CommandType = CommandType.Text;

note : str_MSISDN is the StringBuilder which stores the Number which is inserted in TextField.

Answer 1

You should be using proper SQL parameters. NEVER use string building since that leaves you open for injection attacks.

Read this tutorial to learn how to add parameters to SqlCommands.