'='附近的语法不正确.在代码c#中

Question

我正在开发ac#windows表单应用程序,它保存学生的信息,如名称课程年份等.我保存到sql数据库的代码可以工作,但是当涉及到检索信息时,我得到这些错误,错误的语法在'='附近.我认为错误是在retreive code.please帮助:)

这是检索代码:

try
{
    string sql = "SELECT studnum,course,f_name,l_name,color_image FROM table3 WHERE f_name=" + textBoxfname.Text + "";
    if (conn.State != ConnectionState.Open)
        conn.Open();
    command = new SqlCommand(sql, conn);
    SqlDataReader reader = command.ExecuteReader();
    reader.Read();
    if (reader.HasRows)
    {
        labeloutputstudnum.Text = reader[0].ToString();
        labeloutputcourse.Text = reader[1].ToString();
        labeloutputfname.Text = reader[2].ToString();
        labeloutputlname.Text = reader[3].ToString();
        byte[] img = (byte[])(reader[4]);
        if (img == null)
            pictureBox3.Image = null;
        else
        {
            MemoryStream ms = new MemoryStream(img);
            pictureBox3.Image = Image.FromStream(ms);
        }
    }
    else
    {
        textBoxstudno.Text = "";
        textBoxcourse.Text = "";
        textBoxfname.Text = "";
        textBoxlname.Text = "";
        pictureBox3.Image = null;
        MessageBox.Show("does not exist");
    }
    conn.Close();
}
catch (Exception ex)
{
    conn.Close();
    MessageBox.Show(ex.Message);
}

Answer 1

string sql = "SELECT studnum,course,f_name,l_name,color_image FROM table3 WHERE f_name=@Name";
command = new SqlCommand(sql, conn);
command.Parameters.Add(new SqlParameter("@Name", textBoxfname.Text));