How do I execute an SQL statement?

You have a lot of options in how to execute a SQL statement with .NET. Read up on the following for starters. These are the first three technologies I usually consider when deciding how to access the database:

• ADO.NET
• Dapper
• Entity Framework

From Microsoft:

ADO.NET provides the most direct method of data access within the .NET Framework. For a higher-level abstraction that allows applications to work against a conceptual model instead of the underlying storage model, see the ADO.NET Entity Framework.

Lately, my go-to technology for database access is Dapper. It is fast, lightweight, and plain convenient to code with.

Assuming you are using SqlServer as your database:

The SqlCommand and SqlConnection classes will be of use to you here, so I would have a look at those.

Also Stored Procedures are a great way to go as they are more secure, and perform slightly faster than sending the query to the server. A quick google for the benefits of Stored procs will help you here

One thing to make note of is there are different ways to execute your query. The SqlCommand class has quite a few methods for instance ExecuteNonQuery() will just run a sql command that does not return data (such as an insert or delete) whereas ExecuteScalar will execute a query that returns only one value.

There are other options such as creating a DataTable and then using a DataAdapter to fill the table.

I will post some examples of my database connect code, sorry it's in VB but you should be able to convert to C# easily enough.

Firstly this is a connection using a data adapter

  Dim dt As New DataTable

  ' There are plenty of options you can use with the SqlConnection constructor so you can just modify this to suit your needs
  Dim conn As New SqlConnection(ConfigurationManager.ConnectionStrings("Blueprint").ToString())

  Dim cmd As New SqlCommand
  cmd.CommandType = CommandType.StoredProcedure
  cmd.CommandText = "spGetMenuItemsForTickets"
  ' parameters could be added here by doing
  ' cmd.parameters.addwithvalue("@ParamName",value)
  cmd.Connection = conn

  Using da As New SqlDataAdapter(cmd)
     conn.Open()
     da.Fill(dt)
     conn.Close()
  End Using

This is an example of using ExecuteScalar

Dim names As String = String.Empty

  Dim ds As New DataTable

  Dim conn As New SqlConnection(ConfigurationManager.ConnectionStrings("Blueprint").ToString())

  Dim cmd As New SqlCommand
  cmd.CommandType = CommandType.StoredProcedure
  cmd.CommandText = "spGetUserNamesForUpdate"
  cmd.Parameters.AddWithValue("@TicketID", TicketID)

  cmd.Connection = conn

  conn.Open()

  names = cmd.ExecuteScalar()

  conn.Close()

This is an example of ExecuteNonQuery It is pretty much identical to Scalar but without the returned value

     Dim conn As New SqlConnection(ConfigurationManager.ConnectionStrings("Blueprint").ToString())

     Dim cmd As New SqlCommand

     cmd.CommandType = CommandType.StoredProcedure
     cmd.CommandText = "spAddFileToTicket"

     cmd.Parameters.AddWithValue("@ticketID", TicketID)
     cmd.Parameters.AddWithValue("@filename", Filename)
     cmd.Parameters.AddWithValue("@filePath", Filepath)
     cmd.Parameters.AddWithValue("@comments", Comment)

     cmd.Connection = conn

     conn.Open()
     cmd.ExecuteNonQuery()
     conn.Close()

Also in your SQL where you do LIKE ' __ ' you will probably want to do LIKE '%__%' as the % are the wildcards, you can use one or both of them, but just doing LIKE '__' would not match a value such as ___1 or 1___ etc