string sql = "textBox1.Text";
            string p;
            int a1 = 0, a2 = 1;
            string s = "";
            if (sql.EndsWith("."))
            {
            }

            else
            {
                p = sql.Substring(a1, a2);
                string ssql = "select sz from 移位密码 where yw=p";
                SqlConnection ds = new SqlConnection(ConfigurationManager.ConnectionStrings["connString"].ConnectionString);

                ds.Open();
                SqlCommand bs = new SqlCommand(ssql, ds);
                bs.ExecuteNonQuery();
                int str = Convert.ToInt32(bs);
                ds.Close();
                int k = Convert.ToInt32("textBox3.Text");
                int d = k + str;
                if (d > 25)
                {
                    d = d - 25;
                } string ssql2 = "select yw from 移位密码 where sz=d";
                SqlConnection ds1 = new SqlConnection(ConfigurationManager.ConnectionStrings["connString"].ConnectionString);

                ds.Open();
                SqlCommand bs1 = new SqlCommand(ssql2, ds1);
                bs1.ExecuteNonQuery();
                string str1 = Convert.ToString(bs1);
                ds1.Close();
                a1++;
                a2++;

                s = s + str1;

            }
            textBox2.Text = s;
        


着色的地方显示列名p无效，不懂哪里错了

string ssql = "select sz from 移位密码 where yw="+p; //最好用参数化 这里什么意思啊，什么叫参数化呀，不懂哎，求解

试了不行还是原来那个问题啊

有人没有啊，求大神帮助啊