serkan sendur offcourse it vulnerable to sql injection,
but i dont know if you noticed above is a beginner to c#,
and as it seems he is a beginner in programing as well, so we are not dealing with vulnerabilty here, he simply wants to start to learn.

i want show my result of search in a datagridview. i just want selected title o date i key in show there.

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Data.SqlClient;
using System.Configuration;

namespace WindowsFormsApplication7
{
public partial class Form7 : Form
{
public Form7()
{
InitializeComponent();
}

private void BindDataGrid()
{
SqlConnection myConn = new SqlConnection();
myConn.ConnectionString = ConfigurationManager.ConnectionStrings["myConn"].ToString();

myConn.Open();


string strSQL = "select * from book where user_id = " + StaticData.ActiveUserId + "";
SqlDataAdapter dataAdapter = new SqlDataAdapter(strSQL, myConn);
SqlCommandBuilder commandBuilder = new SqlCommandBuilder(dataAdapter);

SqlCommand cmd = new SqlCommand("select user_id from book where user_id = " + StaticData.ActiveUserId + "", myConn);

DataTable table = new DataTable();
dataAdapter.Fill(table);
bindingSource1.DataSource = table;
dataGridView1.DataSource = bindingSource1;

myConn.Close();
}



private void button1_Click(object sender, EventArgs e)
{

SqlConnection myConn = new SqlConnection();
myConn.ConnectionString = ConfigurationManager.ConnectionStrings["myConn"].ToString();

myConn.Open();

if (txtTitle.Text != "")
{

SqlCommand cmd = new SqlCommand("SELECT * from book WHERE title = " + txtTitle.Text.ToString());

SqlDataReader dr;
dr = cmd.ExecuteReader();

BindDataGrid();

dr.Close();
}
else if (txtDate.Text != "")
{
SqlCommand cmd = new SqlCommand("SELECT * from book WHERE dateofpurchase = " + txtDate.Text.ToString());

SqlDataReader dr;
dr = cmd.ExecuteReader();

dr.Close();
}


myConn.Close();




}
}
}

you should add the parameters like below :


"Tang" will be your textbox.text.

i posted an example as how to create parameters in secure way. this way it will be protected against injection.

dummy c# you are now using two different methods of polling the data from the DB, either you want to use DataBind or you want to use SqlDataReader, choose one and we will continue from there.

and you have not still added the:
Method

WOW you are so centered in your self that you quote me and tell me sonthing else, I KNOW HOW TO DO IT IN A SECURE WAY, BUT ITS NOT THE ISSUE...!!!

what were you expecting ? am i going to be "you" centered, of course i am self-centered.
if you teach someone something, why not teach it correct from the beginning?

Becuase when you teach a baby to talk you are not teaching him how to say "encyclopedia" from the begining you teaching him how to say "dad", "mom" and so on, when he learned that so you going and teach him how to say "cow", "cat" and after you teach him to say "encyclopedia".

I'm sure when you started to learn programing you didnt learn how to id in a secure way from the begining you learned the basicics and then you developed to what you know today, so take it easy with the fellow

I dont think so, even in the microsoft websites beginning tutorials for novices, it teaches how to do it proper way from the beginning. Using one more object is better than making quotation mistakes in a select statement as well as security issue.

Well obviously you are not a perent and not a teacher either.
If you still think that you are right so stay in your mind, I cant force you to change the way you think, but I'm sure that people here will agree with me.