Retrieve data from asp.net webform - asp.net

Question

What is wrong in this program??
it shows error in da.Fill(dt);. This program is for searching record from DataBase by Name.
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Configuration;
using System.Data;
using System.Threading.Tasks;
public partial class NameSearch : System.Web.UI.Page
{
public SqlConnection con = new
SqlConnection(ConfigurationManager.ConnectionStrings["ConnectionString"].
ConnectionString);
protected void Page_Load(object sender, EventArgs e)
{
con.Open();
}
protected void btnSearch_Click(object sender, EventArgs e)
{
SqlCommand cmd = new SqlCommand("select * from case1 where
Name="+txtSearchName.Text,con);
cmd.CommandType = CommandType.StoredProcedure;
SqlDataAdapter da = new SqlDataAdapter(cmd);
DataSet dt = new DataSet();
da.SelectCommand = cmd;
da.Fill(dt);
GridView1.DataSource = dt;
cmd.ExecuteNonQuery();
con.Close();
}
}

Answer 1

SqlCommand cmd = new SqlCommand("select * from case1 where
Name='"+txtSearchName.Text + "'",con);
cmd.CommandType = CommandType.Text;
SqlDataAdapter da = new SqlDataAdapter(cmd);
DataSet ds= new DataSet();
da.SelectCommand = cmd;
da.Fill(ds, "FooTable");
GridView1.DataSource = ds.Tables["FooTable"];;
cmd.ExecuteNonQuery();
con.Close();

Answer 2

You have to use Text in commandtype instead of StoredProcedure..Use parameterized query to avoid sql injection
string name=txtSearchName.Text;
SqlCommand cmd = new SqlCommand("select * from case1 where Name=#name",con);
cmd .Parameters.AddWithValue("#name", name);
cmd.CommandType = CommandType.Text;
da.SelectCommand = cmd;
da.Fill(dt);
GridView1.DataSource = dt;
GridView1.DataBind();
con.Close();