What is the use of single and double quotes in SQL?

Question

I'm passing a string or number to a SQL query.

What is the meaning of single quotes and a single within double quotes?

select * from college where class = '"+txtclass.Text+"'

or

select * from college where class = '+txtclass.Text+'

Answer 1

You should use parameters for the SqlCommand.

Here a small example on how to do it:

using (var con = new SqlConnection("conection string"))
{
    con.Open();
    using (var cmd = con.CreateCommand())
    {
        // Here is where we add the parameters into the Sql Query, this way it will prevent SQL Injection
        cmd.CommandText = "select * from college where class = @class";
        // Now we add the value to the parameter @class, I'm assuming here that the column class is a NVarchar
        cmd.Parameters.Add("@class", SqlDbType.NVarChar).Value = txtclass.Text;
        using (var dr = cmd.ExecuteReader())
        {
            while (dr.Read())
            {
                // Do some code
            }
            dr.Close();
        }
    }
}

this example is for Sql, but the same can be done to MySql, we just need to use the MySql classes, the rest is the same

Note: I know this doesn't answer the question that as been made, but since there is a security risk the way he is doing, I decided to give an simple example how to make it more secure, since the answer as been given on the comments on the question