Database

string sql= [whatever the user passes in]

SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings[Utils.GetConnectionString].ToString());
        connection.Open();

        SqlCommand command = connection.CreateCommand();
        command.CommandType = CommandType.Text;
        command.CommandText = sql;


        try
        {
            int result = command.ExecuteNonQuery();

            if (result != 1)
            {
                Response.StatusCode = 500;
                Response.Write("The file has been uploaded, but we could not update the DB");
                Response.End();
            }
        }
        catch (InvalidOperationException)
        {
            Response.Clear();
            Response.Write("error");
            Response.StatusCode = 500;
            Response.End();
        }

        connection.Close();

declare @i  as Integer<br />
set @i=1;<br />
<br />
select tablename.ColName where Col.ID=@i