It doesn't matter if the text box is created dynamically or not. The basic principle is always the same:
- get the value from a control
- set the value into a parameter
- execute the parameterized statement.
In other words, you should use an SQL statement which uses parameters as explained in
SqlParameter[
^]