C# 在把变量嵌入SQL中

string mysql = 
    "SELECT Cname,Grade 
      FROM student,score,course 
      WHERE student.Sno = score.Sno and 
                  score.Cno = course.Cno and 
                  student.Sno = ‘" + Convert.ToString(textBox1.Text) + "’ and         
                  score.Text =‘" + Convert.ToInt32(comboBox1.Text) + “’;
    ”; 

string mysql = string.Format(
    "SELECT Cname,Grade 
     FROM student,score,course 
     WHERE student.Sno = score.Sno and 
                score.Cno = course.Cno and 
                student.Sno = ‘{0}‘ and 
                score.Text = ‘{1}‘ " ,
    textbox1.Text,ComboBox1.Text);