When u need to pass parameters to sql Query. This can be done in two ways..
First one:
SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings["MyConnectionString"].ConnectionString);
string query = "select * from table where columnName = '" + txtSearch.Text + "'";
SqlCommandcommand = new SqlCommand(query,connection);
Bur this approach is not recommended. this may lead to error sometimes. So, whenever we need to pass parameters to query, use SqlParamater. The same query can be written as..
string query = "select * from table where columnName =@value";
SqlCommand command = new SqlCommand(query,connection);
command.Parameters.AddWithValue("@value",txtSearch.Text);
Using SqlParameters gives a cleaner, less error prone and SQL injection safe (comparative) code.