Deleting records from a table, is this correct?

I want to delete some record from table ,by running this Query in C# is it Correct or not,

Please help me

开发者_C百科SqlCommand cmdRe = new SqlCommand("insert into msisdn_master SELECT *  from tblDeactive
where msisdn in (" + str_MSISDN + ")", cn);
SqlCommand cmdRed = new SqlCommand("delete from tblDeactive where msisdn in ("+str_MSISDN+")", cn);
cmdRe.CommandType = CommandType.Text;
cmdRed.CommandType = CommandType.Text;

note : str_MSISDN is the StringBuilder which stores the Number which is inserted in TextField.

You should be using proper SQL parameters. NEVER use string building since that leaves you open for injection attacks.

Read this tutorial to learn how to add parameters to SqlCommands.