ASP.NET

Hai All, 
I am having two methods in a single service below. I will host this service in IIS. I will be having only one service URL. Client will consume this service by creating the proxy class as usual. But Mehod1 should only be displayed to Client A,  Mehod2 should only be displayed to Client B. How can I overcome this scenario?.. Can you please clarify my doubt..? Thanks in Advance

namespace serviceHide
{
    [ServiceContract]
    interface IServiceHide
    {
        [OperationContract]
        string Method1(string id); //This method should be displayed to Client A only

        [OperationContract]
        string Method2(string id); //This method should be displayed to Client B only

    }
}

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;

public partial class plrsmkt_calculation : System.Web.UI.Page
{

    protected void Page_Load(object sender, EventArgs e)
    {
            }

    int totalrs = 0;
    protected void GridView1_RowDataBound(object sender, GridViewRowEventArgs e)
    {
        if (e.Row.RowType == DataControlRowType.DataRow)
        {
            totalrs += Convert.ToInt32(DataBinder.Eval(e.Row.DataItem, "rs"));
        }
        else if (e.Row.RowType == DataControlRowType.Footer)
        {
            e.Row.Cells[1].Text = "Total";
            e.Row.Cells[1].Font.Bold = true;

            e.Row.Cells[2].Text = totalrs.ToString();
            e.Row.Cells[2].Font.Bold = true;

            e.Row.Cells[3].Text = totalrs.ToString();
            e.Row.Cells[3].Font.Bold = true;

        }


    }
    protected void TextBox1_TextChanged(object sender, EventArgs e)
    {

    }
}

string sqlQuery = "UPDATE rights SET category_key = " + toCat + " WHERE rights_key = @rights_key";
QueryContainer Instance = new QueryContainer(sqlQuery);

ExecuteNonQuery(sqlQuery);

<pre>

Also when  I do an SQL ExecuteScaler statement I am using from a C# client I am adding C# variables to the hard coded values in the SQL statement Execute ExecuteScaler client like this:

<pre>

queryString.Append(" SELECT isnull(");
queryString.Append("    (SELECT CASE WHEN convert(smalldatetime, '" + valDateMaterialRequired + "')  < (getdate() + isNull(hier_asp_config.late_days_num, 3)) THEN '1' ELSE '0' END");
queryString.Append("    FROM hier_asp_config ");
queryString.Append("    WHERE asp_key = " + aspKey + " )");
queryString.Append(" , CASE WHEN convert(smalldatetime, '" + valDateMaterialRequired + "')  < (getdate() + 3) THEN '1' ELSE '0' END)");


 return ExecuteScaler(queryString.ToString()).ToString();

<pre>

Now in the Class that calls the actual SQL I am using these techniques:

<pre>

protected int ExecuteNonQuery(string queryString)
        {
            int returnValue = 0;

            if (!_iserror)
            {
                if (_trace)
                    DoTrace("TAMIS.Data.Loader.ExecuteNonQuery", queryString);

                if (_connection == null || _connection.State == ConnectionState.Closed)
                {
                    OpenConnection();
                }

                DbCommand command = _provider.CreateCommand();
                command.Connection = _connection;
                command.CommandText = queryString;
                command.CommandType = CommandType.Text;
                if (_useTransaction) { command.Transaction = _transaction; }

                try
                {
                    returnValue = command.ExecuteNonQuery();
                }
                catch (Exception e)
                {
                    if (e is EntryPointNotFoundException)
                        throw e;
                    //if (_useTransaction == true)
                    //    _transaction.Rollback();
                    RollBack();
                    LogBLL bll = new LogBLL();
                    bll.WriteErrorLog(e);
                    _iserror = true;
                }
                finally
                {

                    if ((!KeepAlive && _connection.State == ConnectionState.Open) || _iserror == true)
                    {
                        CloseConnection();
                    }

                }

            }
            else
            {
                returnValue = -1;
            }

            return returnValue;
        }
<pre>

And this:

<pre>
protected object ExecuteScaler(string queryString)
        {

            object returnValue = null;
            if (!_iserror)
            {
                if (_trace)
                { DoTrace("TAMIS.Data.Loader.ExecuteScalar", queryString); }

                if (_connection == null || _connection.State == ConnectionState.Closed)
                {
                    OpenConnection();
                }

                DbCommand command = _provider.CreateCommand();
                command.Connection = _connection;
                command.CommandText = queryString;
                command.CommandType = CommandType.Text;
                if (_useTransaction) { command.Transaction = _transaction; }

                try
                {
                    returnValue = command.ExecuteScalar();
                }
                catch (Exception ex)
                {
                    if (ex is EntryPointNotFoundException)
                        throw ex;
                    //if (_useTransaction == true)
                    //_transaction.Rollback();
                    RollBack();

                    LogBLL bll = new LogBLL();
                    bll.WriteErrorLog(ex);

                   _iserror = true;
                }
                finally
                {

                    if ((!KeepAlive && _connection.State == ConnectionState.Open) || _iserror == true)
                    {
                        CloseConnection();

                    }

                }
            }
            else
            {
                returnValue = -1;
            }

            return returnValue;
        }
<pre>

These are clearly giving me SQL injection errors. In my case I cant change the code to stored procedures like they should be so How do I make the C# variable values from my client calling code and still work but not give me SQL injection errors?