c# - Renaming a Field name by accepting values from textboxes...It shows "Unclosed quotation mark after the character string '' -

i using text boxes, textbox1 accepts value existing field , textbox2 accepts new field name. when click on button, corresponding field name entered in textbox1 in d/b should change entered in textbox2.

protected void button1_click(object sender, eventargs e) { //str = "sp_rename 'book.author','au_name','column'";

    str = "sp_rename 'book.'" + textbox1.text + "','" + textbox2.text + "','column'";     sqlconnection con = new sqlconnection("data source=.;initial catalog= library;integrated security=true");     con.open();     sqlcommand cmd = new sqlcommand(str, con);     sqldatareader dr = cmd.executereader();      //("select * imslogin uname = '" + uname + "' , pwd= '" + pwd + "'", con) 

}

thanks much,

thanks in advance!!

the first , obvious problem user input sent directly db.

the second problem, may solve question, single quotation behing sp_rename 'book.

from comment: replace

str = "sp_rename 'book.'" + textbox1.text 

with

str = "sp_rename 'book." + textbox1.text  

(and maybe add checks on content of textbox1.text)