asp.net - select Query with AND Condition -

i want select user cant . here's query

        sqlcommand mycommand = new sqlcommand("select * users email=" + useremailpass.email + "and password=" + useremailpass.password, conn);         sqldatareader detailsreader = mycommand.executereader(); 

is query correct or not>? please help

if email , password string fields need encapsulate values used comparison in single quotes, correct way use parameterized query

sqlcommand mycommand = new sqlcommand("select * users " +                             "where email=@mail , password=@pwd" conn); mycommand.parameters.addwithvalue("@mail",useremailpass.email); mycommand.parameters.addwithvalue("@pwd",useremailpass.password); sqldatareader detailsreader = mycommand.executereader(); 

if use parameterized query avoid sql injection problem , don't have worry encapsulate string values quotes, doubling them if values contain quote, not mention appropriate decimal separator numerics , correct formatting of dates.

an overlooked benefit of parameterized query clear , understandable text of query. pointed out mr tim schmelter below, query has syntax error missing space between , and previous value in clause. kind of errors more difficult if write parameterized query.

give me parameterized query or give me death