System.Data.SqlClient.SqlException: 'Unclosed quotation mark after the character string 'MX12011'. Incorrect syntax near 'MX12011'.'

Question

Hello, I use a nested GridView (into a GridView), but it throws me an error when I try to start the program, "MX12011" it's one of the ID I have in the DataBase, the idea of the program it's, when I click in the "+" Button, it show the Nested GridView with the specific ID, so I don't know what I'm doing wrong.

 protected void Page_Load(object sender, EventArgs e)  
        {  
            if (!IsPostBack)  
            {  
                gvCustomers.DataSource = GetData("SELECT distinct No_curso, Room, Idioma, Fecha_inicio, Fecha_final, Training, PMax from Agregar_sesion");  
                gvCustomers.DataBind();  
            }  
        }  
        private static DataTable GetData(string query)  
        {  
            string strConnString = ConfigurationManager.ConnectionStrings["constr"].ConnectionString;  
            using (SqlConnection con = new SqlConnection(strConnString))  
            {  
                using (SqlCommand cmd = new SqlCommand())  
                {  
                    cmd.CommandText = query;  
                    using (SqlDataAdapter sda = new SqlDataAdapter())  
                    {  
                        cmd.Connection = con;  
                        sda.SelectCommand = cmd;  
                        using (DataSet ds = new DataSet())  
                        {  
                            DataTable dt = new DataTable();  
                            sda.Fill(dt);  
                            return dt;  
                        }  
                    }  
                }  
            }  
        }  
  
        protected void OnRowDataBound(object sender, GridViewRowEventArgs e)  
        {  
              
            if (e.Row.RowType == DataControlRowType.DataRow)  
            {  
                string curso = gvCustomers.DataKeys[e.Row.RowIndex].Value.ToString();  
                GridView gvOrders = e.Row.FindControl("gvOrders") as GridView;  
                gvOrders.DataSource = GetData(string.Format("SELECT distinct AgS.No_curso, AgS.Fecha_inicio, M.Num_empleado, M.Nombre,M.Leader From Agregar_sesion Ags, Maestro M WHERE  Ags.No_emp = M.Num_empleado and Ags.No_curso ='" + curso));  
                gvOrders.DataBind();  
            }  
        }  

HTML (In some parts I delete the '=' because learn.microsoft.com throws me error to publish the code):

<asp:GridView ID="gvCustomers" runat="server" AutoGenerateColumns="false" CssClass="Grid" DataKeyNames="No_curso" OnRowDataBound="OnRowDataBound">  
<Columns>  
    <asp:TemplateField>  
                    <ItemTemplate>  
    <img alt  "" style"cursor: pointer" src"images/plus.png" />  
                        <asp:Panel ID"pnlOrders" runat="server" Style"display: none">  
    <asp:GridView ID="gvOrders" runat="server" AutoGenerateColumns="false" CssClass = "ChildGrid" DataKeyName="No_curso">  
    <Columns>  
                                    <asp:BoundField DataField="No_curso" HeaderText="# de Curso" SortExpression="No_curso" />  
                                    <asp:BoundField DataField="Fecha_inicio" HeaderText="Fecha aplicada" SortExpression="Fecha_inicio" />  
                                    <asp:BoundField DataField="Num_empleado" HeaderText="# de empleado" SortExpression="Num_empleado" />  
                                    <asp:BoundField DataField="Nombre" HeaderText="Nombre" SortExpression="Nombre" />  
                                    <asp:BoundField DataField="Leader" HeaderText="Gerente" SortExpression="Leader" />  
                                </Columns>  
    </asp:GridView>  
                        </asp:Panel>  
                    </ItemTemplate>  
                </asp:TemplateField>  
    <asp:BoundField ItemStyle-Width="150px" DataField="No_curso" HeaderText="Contact Name" />  
                <asp:BoundField ItemStyle-Width="150px" DataField="Room" HeaderText="City" />  
                <asp:BoundField ItemStyle-Width="150px" DataField="Idioma" HeaderText="City" />  
                <asp:BoundField ItemStyle-Width="150px" DataField="Fecha_inicio" HeaderText="City" />  
                <asp:BoundField ItemStyle-Width="150px" DataField="Fecha_final" HeaderText="City" />  
                <asp:BoundField ItemStyle-Width="150px" DataField="Training" HeaderText="City" />  
                <asp:BoundField ItemStyle-Width="150px" DataField="PMax" HeaderText="City" />  
    </Columns>  
        </asp:GridView>  
        </form>  
    </body>  
    </html>  

Answer 1

Try adding the missing " ' ":

gvOrders.DataSource = GetData(string.Format("SELECT . . . and Ags.No_curso ='{0}'", curso));

However, consider the Parameterised Queries too.