c# datetimepicker did not work with sql parameters and work with directly like sql injection : string sqlconf = ConfigurationManager.ConnectionStrings["sqlconstr"].ConnectionString;
            string pathconf = ConfigurationManager.AppSettings["expath"].ToString();
            string sql = "select userid,logdate from Devicelogs_1_2015 where convert(varchar(10),LogDate,103) between '@fdate' and '@tdate';";

                StreamWriter sw = new StreamWriter(pathconf);
                SqlConnection sqlcon = new SqlConnection(sqlconf);
                SqlCommand sqlcom = new SqlCommand(sql, sqlcon);
            
                sqlcom.Parameters.Add("@fdate", SqlDbType.VarChar).Value = dateTimePicker1.Value.ToString("dd/MM/yyyy");
                sqlcom.Parameters.Add("@tdate", SqlDbType.VarChar).Value = dateTimePicker2.Value.ToString("dd/MM/yyyy");

                sqlcon.Open();
                using (sqlcon)
                {

                    using (SqlDataReader sqldr = sqlcom.ExecuteReader())
                    {
                        while (sqldr.Read())
                        {
                            string userid1 = sqldr.GetString(0);
                            DateTime logdate1 = sqldr.GetDateTime(1);

                            sw.WriteLine("{0},{1}", userid1, logdate1.ToString("yyyy-MM-dd HH:mm:ss"));

                        }
                        sw.Close();
                        sqldr.Close();
                    }

                    sqlcon.Close();
                    MessageBox.Show("File Exported Successfully");
                    Close();
                }
            
        }