Database

SqlString = "SELECT * FROM Accounts ";
SqlString += "WHERE (Nick = '"; 
SqlString += tNick;
SqlString += "')";

SqlString = "SELECT * FROM Accounts WHERE (Nick = 'tNick');

public void StorePicture( string filename ) {
  // Read the file into a byte array
  FileStream fs = new FileStream( filename, FileMode.Open, FileAccess.Read );
  byte[] imageData = new Byte[fs.Length];
  fs.Read( imageData, 0, (int)fs.Length );
  fs.Close();

  SqlConnection conn = new SqlConnection("Connection String");
  SqlCommand cmd = new SqlCommand("StorePicture", conn);
  cmd.CommandType = CommandType.StoredProcedure;
  cmd.Parameters.Add("@filename", filename );
  cmd.Parameters["@filename"].Direction = ParameterDirection.Input;
  cmd.Parameters.Add("@blobdata", SqlDbType.Image);
  cmd.Parameters["@blobdata"].Direction = ParameterDirection.Input;
  // Store the byte array within the image field
  cmd.Parameters["@blobdata"].Value = imageData;
  try {
    conn.Open();
    cmd.ExecuteNonQuery();
  }
  catch {
    throw;
  }
  finally {
    conn.Close();
  }
}