使用SQL Server Management Studio进行数据库查询时遇到麻烦

Question

I'm quite stuck in my programming when I query some of my data,

I want to sort my database student to arrange by year I did use order by year in SQL Server like this:

select *   
from Student 
where year >=1 and year <= 4 
order by year;

The code seems to work but when I query my data in the aspx.cs code behind, the program alerts me with an error.

This is my aspx code behind sample:

string yearfrom = (this.YearFrom.Value);
string yearto = (this.YearTo.Value);

if(yearfrom != "yearfrom1" && yearto != "yearto2")
{
   query = "select * from student where year >= '" + yearfrom + "' and year <= '" + yearto + "order by year'";
}

The query I used in here doesn't seem to work, I don't know why.

Answer 1

I've found the solution the answer post by @Steve is also correct.

if(yearfrom != "yearfrom1" && yearto != "yearto2")
{
   query = @"select * from student 
             where [year] >= @from and [year] <= @to 
             order by [year]";
}

this one is also applicable posted by @DeepakPawar a minute ago.

query = "select * from student where year >= " + yearfrom + " and year <= " + yearto + " order by year";

thank you guys for helping me.