In the spirit of Donnies answer, I've provided a simple SQL example of how to retrieve what you're after using a more securable mechanism than dynamically constructed SQL (as others have advised you)
In the simple case, you should create a stored procedure for each Create, Read, Update, Delete operation available to the application, per entity in the database. (This isn't 100% true in large production systems, but it's better than dynamically generated SQL constructed in the application)
Now for the READ, this lists all if no parameter is provided. This is a simplified version of an approach a database architect at my job has lectured on -- here we don't separate the retrieve stored procedure from the listing procedure, they are effectively the same operation. This will pay out in less SQL code to maintain in the long run.
CREATE PROCEDURE usp_ReadName
@name_id bigint=NULL
AS
BEGIN
SET NOCOUNT ON;
if (@name_id IS NULL)
SELECT name_id,name,description
from name with(nolock)
else
select name_id,name,description
from name with(nolock)
where name_id = @name_id
END
GO
Now for the C# side.
To hold the results we define a data transfer entity. Generally speaking these are lighter weight than a datatable faster and more efficient to use. If speed, large volumes of data or limited memory are not a concern just go with a datatable. (On average you'll save roughly 40%+ memory, and about 10% speed - 100K records of the structure above peaks memory use at 140MB with a datatable while the DTE peaks at 78MB)
/// <summary>
/// A simple data transfer entity
/// </summary>
public struct name_data
{
public long name_id;
public string name;
public string description;
public name_data(long id, string n, string d)
{
name_id = id;
name = n;
description = d;
}
}
Now we capture the results in C# using the nullable parameter syntax. This code assumes you've already opened the sql connection
conn.Open();
using (SqlCommand cmd = new SqlCommand("usp_ReadName",conn))
{
cmd.CommandType = CommandType.StoredProcedure;
if (id.HasValue)
cmd.Parameters.Add("@name_id", SqlDbType.BigInt).Value = id.Value;
using (SqlDataReader reader = cmd.ExecuteReader())
{
if (reader.HasRows)
{
while (reader.Read())
{
dte.name_data item = new dte.name_data(
(long)reader["name_id"],
reader["name"].ToString(),
reader["description"].ToString());
items.Add(item);
}
}
}
}