Use Sql Parameter in C#

    public string GetConnectionString()
    {
        //we will set up the configuration which will call our
        //web.config file to provide the database details because
        //in configuration file we have created the <connectionStrings>
        //in the process we draged and droped. It creates automatically.
        //We normally put the database details in web.config file or
        //machine.config file because it is very sensitive information
        //usually there IP address of remote database, passwords and
        //user names are stored.

        return System.Configuration.ConfigurationManager.ConnectionStrings
            ["onlineapplicationformConnectionString1"].ConnectionString;
        //in above line "onlineapplicationformConnectionString1" is
        //our configuration name which is inside the web.config file.
    }

    private void execution(string fname, string lname, string dob, string gender, string fathername, string contact, string address)
    {      
        //In above line we declaring different variables same as backend
        SqlConnection conn = new SqlConnection(GetConnectionString());
        //In above line we are calling connection
        //string function which is defined already on top
        string sql = "INSERT INTO regiistrationform (fname, lname, dob, gender, fathername, contact, per_address) VALUES "
        + " (@fname, @lname, @dob, @gender, @fathername, @contact, @per_address)";
        //In above lines we are just storing the sql commands which
        //will insert value in onlineapplication named table,
        //using variable named sql.
        try
        {
            conn.Open();
            SqlCommand cmd = new SqlCommand(sql, conn);
            //In above lines we are opening the connection to work and
            //also storing connection name and sql command in cmd variable
            //which has 'SqlCommand' type.
            SqlParameter[] pram = new SqlParameter[7];
 
            //In above lines we are defining 7 sql parameters will be use
            //In below lines we will not disscuss about id column
            pram[0] = new SqlParameter("@fname", SqlDbType.VarChar, 10);
            pram[1] = new SqlParameter("@lname", SqlDbType.VarChar, 50);
            pram[2] = new SqlParameter("@dob", SqlDbType.VarChar, 50);
            pram[3] = new SqlParameter("@gender", SqlDbType.Char, 10);
            pram[4] = new SqlParameter("@fathername", SqlDbType.VarChar, 50);
            pram[5] = new SqlParameter("@contact", SqlDbType.Int, 20);
            pram[6] = new SqlParameter("@per_address", SqlDbType.VarChar, 100);
            //Now we set-uped all fiels in database in above lines
            //Now we will set-up form fields
            pram[0].Value = fname;
            pram[1].Value = lname;
            pram[2].Value = Convert.ToDateTime ( dob);
            pram[3].Value = gender;
            pram[4].Value = fathername;
            pram[5].Value = Convert.ToInt32( contact);
            pram[6].Value = address;
            //Now create loop to insert
            for (int i = 0; i < pram.Length; i++)
            {
                cmd.Parameters.Add(pram[i]);
            }
            for (int i = 0; i < pram.Length; i++)
            {
                cmd.Parameters.Add(pram[i]);
            }
            cmd.CommandType = CommandType.Text;
            cmd.ExecuteNonQuery();
        }
        catch(System.Data.SqlClient.SqlException ex_msg)
        {
            //Here will be catch elements
            string msg = "Error occured while inserting";
            msg += ex_msg.Message;
            throw new Exception(msg);
        }
        finally
        {
            //Here will be fially elements
            conn.Close();
        }
   
    }

    protected void Page_Load(object sender, EventArgs e)
    {

    }
    protected void submit_Click(object sender, EventArgs e)
    {
        //Here is the command inside the click event of button
        if(fname.Text=="")
        {
            Response.Write("Please complete the form.");
        }
        else
        {
            execution(fname.Text,lname.Text,dob.Text,gender.Text,fathername.Text,contact.Text,address.Text);
            conform.Visible = true;
            fname.Text="";
            lname.Text="";
            dob.Text="";
            gender.Text="";
            gender.Text="";
            fathername.Text="";
            contact.Text="";
            address.Text="";
        }
    }
    protected void gender_TextChanged(object sender, EventArgs e)
    {
}
    protected void Button1_Click(object sender, EventArgs e)
    {
        SqlConnection conn = new SqlConnection(GetConnectionString());
        //In above line we are calling connection
        //string function which is defined already on top
        conn.Open();


        string sql = "select * from regiistrationform";
        SqlCommand cmd = new SqlCommand(sql, conn);
        SqlDataAdapter adapter = new SqlDataAdapter(cmd);
        DataTable dt =new DataTable();
        adapter.Fill(dt);
       
        string strName =dt.Rows.Add("fname").ToString();
    foreach (DataRow dr in dt.Rows )
    {
     

        }

    }
}