sql server - SQL Query to Select by String ID -

i have below line of code in asp.net page

var strselect = string.format("select emailaddress dbo.master stringid='", values["stringid"], "'"); 

this results in error

unclosed quotation mark after character string ''.
incorrect syntax near ''.

what's wrong syntax?

source error:

 line 65:                   cmd.connection.close();  line 66:               if (!mvcfunctions.handleerror())  line 67:                   throw e;  line 68:               return null;  line 69:             } 

you're not using string.format correctly:

var strselect = string.format("select emailaddress dbo.master stringid='",                    values["stringid"], "'"); 

should be

var strselect =       string.format("select emailaddress dbo.master stringid='{0}'",                    values["stringid"]); 

additional information: http://msdn.microsoft.com/en-us/library/system.string.format(v=vs.110).aspx

with said, please using parameterized queries can vulnerable sql injection.