Question

when we want to pass sth to database like int we use(%d) like below

...string.format("select * from Table where code=%d",100)...

what should i use instead of %d when we want to pass dateTime ?

Answer 1

dont use string.format() for db parameter substitution, you end up in SQL injection. SqlCommand has Parameters property , you can add the parameters into the collection

use parameterized query like this:

SqlCommand cmd = new SqlCommand()
cmd.Parameters.AddWithValue("@yourParam",value);

more efficient if you use the Using block with your code.

like this

using(SqlConnection con = new SqlConnection("ConnString"))
using(SqlCommand cmd =  new SqlCommand(con))
{
   // do some stuffs. like add parameters. 
}