Best way to format a string in C# [duplicate]

Your code is suffering from SQL injection.

String formats are more efficient with large strings than string concatenations. They are also slightly easier to read. Both are perfectly valid.

To fix your SQL injection issue, you will want to parametrize your query:

using System;
using System.Data.SqlClient;

class Program
{
    static void Main()
    {
    //
    // The name we are trying to match.
    //
    string dogName = "Fido";
    //
    // Use preset string for connection and open it.
    //
    string connectionString =
        ConsoleApplication1.Properties.Settings.Default.ConnectionString;
    using (SqlConnection connection = new SqlConnection(connectionString))
    {
        connection.Open();
        //
        // Description of SQL command:
        // 1. It selects all cells from rows matching the name.
        // 2. It uses LIKE operator because Name is a Text field.
        // 3. @Name must be added as a new SqlParameter.
        //
        using (SqlCommand command = new SqlCommand(
        "SELECT * FROM Dogs1 WHERE Name LIKE @Name", connection))
        {
        //
        // Add new SqlParameter to the command.
        //
        command.Parameters.Add(new SqlParameter("Name", dogName));
        //
        // Read in the SELECT results.
        //
        SqlDataReader reader = command.ExecuteReader();
        while (reader.Read())
        {
            int weight = reader.GetInt32(0);
            string name = reader.GetString(1);
            string breed = reader.GetString(2);
            Console.WriteLine("Weight = {0}, Name = {1}, Breed = {2}",
            weight,
            name,
            breed);
        }
        }
    }
    }
}

Output (This varies depending on your database contents.)

Weight = 130, Name = Fido, Breed = Bullmastiff

I may be wrong here, but it looks like "grd.CurrentRow.Cells(1).Value" will resolve to a value in your c# code. You then intend to send this to the database. In other words your Format 2 will replace "grd.CurrentRow.Cells(1).Value" with a value before it goes to the database. Your Format 1 won't so is most likely incorrect and will not work.

In terms of performance, parameterizing queries is always recommended as it allows SQL Server's (if that is the database you are using) built in optimizer to build a query plan to optimise regular run queries. It will store this plan in a cache, so if you keep making the same types of queries, SQL Server should know the best way to call it after you have made one\more calls. Using Entity Framework or Stored Procedures to do data access will help you out here rather than building hard coded sql statements.

See these links for more information:

• Simple Parameterization
• Parameters and Execution Plan Reuse