Can I use request.querystring as a SQL query's parameter in ASP.NET?

Question

In ASP.NET I want to make a query on request.querystring but it seems not work.

1.var search = Convert.ToString(Request.QueryString["search"]);                          
2.var query= db.product2s.SqlQuery("select * from product2s where tm ='{0}'",search);

In the webpage I set search="F112130601" ,on the serverside I can see that value request.querystring["search"] is "F112130601",but the server response no record result.

However if I change the code to below line, I can get response when I view the webpage there is some record results from the server.

1.var search="F112130601"; 
2.var query= db.product2s.SqlQuery("select * from product2s where tm ='{0}'",search);

Answer 1

I'm sory.I make a mistake with my query.

the problem is i should not use "" around product code,

http://test.com/home/product?search="F112130601"

when i use below code to access the server i get record

http://test.com/home/product?search=F112130601

thanks for all of your help.