Database -query handling

how to pass dynamic variables in sql query statement?