Question: I am programming in c# and have used a DataGrid for displaying values from Oracle 10g database. I have a table with attributes Id, Sender, Text, Time, Type, Department, Severity and Confidence level. I want to write a query for filter. I have a textbox in which user can enter any name of sender and only the tuples corresponding to that sender should be displayed in the datagrid. 

If I display the full table in the datagrid then it is working fine whereas for the filter I have written the following query but it is giving NULL result.

```
SELECT        E_ID, SENDER, TEXT, "TIME", "TYPE", DEPT, SEVERITY, CONF_LEV
FROM            EMAIL
WHERE        (SENDER = '" & TextBox1.Text & "')

```

what is the problem with the query??

Answer: 
why not you use SqlCommand Parameters. you can try like this, by using parameterized queries you can avoid sql injections. and do give descriptive names to columns, it will avoid confusions with Sql keywords. 

```
string SqlString = "SELECT E_ID, SENDER, TEXT, 'TIME', 'TYPE', DEPT, SEVERITY, CONF_LEV FROM EMAIL WHERE SENDER =@sender"

using(SqlCommand cmd = new SqlCommand(SqlString , conn))
{
  cmd.Parameters.AddWithValue("@sender", Textbox1.Text); 
  cmd.ExecuteNonQuery(); 
}

```
Try like this, 

```
string.Format("SELECT E_ID, SENDER, TEXT, 'TIME', 'TYPE', DEPT, SEVERITY, CONF_LEV FROM EMAIL WHERE SENDER = '{0}'", TextBox1.Text);

```