Asp.net C # pass value code in SQL statements

Asp tutorial. net c # pass value code in SQL statements
// Method 1

Public int userlogin (string username, string userpass)
{

Sqlcommand com = new sqlcommand (string. format ("select influence from userinfo where name = '{0}' and pass = '{1}'", username, userpass), dbconn ());
Int bol;
Bol = convert.toint32(com.exe cutescalar ());
Return bol;

}

// Method 2

Public static datatable dtresult (string strsql, params sqlparameter [] pars)
{
Sqlcnn = new sqlconnection (strcnn );
Sqlcmd = new sqlcommand (strsql, sqlcnn );
Sqlcmd. commandtype = commandtype. text;
If (pars! = Null & pars. length> 0)
{
Foreach (sqlparameter par in pars)
{
Sqlcmd. parameters. add (par );
}
}
Datatable dt = new datatable ();
Sqladapter = new sqldataadapter (sqlcmd );
Try
{
Cnnopen ();
Sqladapter. fill (dt );
}
Catch (exception ex)
{}
Finally
{
Mydispose ();
}
Return dt;
}