C# SQL語句中添加變量條件

string EncodingNameString = MD5(TmpNameString);
string EncodingPassString = MD5(TmpPassString);

string sql = "SELECT tname, tpassword FROM tUser WHERE tname = '"+EncodingNameString+"' AND tpassword = '"+EncodingPassString+"'";