retrieving selected value from checkboxlist and using in sql query

Question

I want to create a sql query based on the selected Item from checkboxlist. Just want to remove last comma from the code below.

    String queryt=" And Brand IN(";
        foreach (ListItem lst in brandcklist.Items)
        {
            if (lst.Selected == true)
            {
               queryt += "'"+lst.Text+"',";
            }
        }
        queryt += ")";
        Label3.Text = queryt;

output for this is
And Brand IN('BlackBerry','Karbonn',)
note the comma after karbonn, I don't want to add comma after last item.

Answer 1

Just replace this line

queryt += ")";

with

queryt=queryt.TrimEnd(',') +")";

Answer 2

Something like this:

String queryt = string.Format(" And Brand IN ({0})", string.join(", ", brandcklist.Items.Where(p=>p.Selected).Select(p=>p.Text)))

But as i said, it' open for SQL injection. Here is better description, how you should do this