Generic getting single value from DB in C#

Usage of String Queries/Mandatory SQL Injection Bits

One of the things I noticed immediately is the use of string queries.

This may not be a big deal, but it leaves you open to SQL injection. (I know, mandatory SQL injection statement.) An easy way to fix this would be to rewrite a bit of your code to accept a SqlCommand object instead. Perhaps you should optionally allow the user to add a SqlConnection to the SqlCommand on their own as well? In a situation like this, I would never actually use the class you have provided as I have no ability to specify my own SqlConnection or SqlCommand.

(Yes, I know you can change the ConnectionString, but if I want to connect to three different DB's for a set of queries, I would need to create three instances of this DataBase class, and then provide a different ConnectionString for each. Likewise, if I had fifty queries to run in one batch, I would have to suffer the performance of it opening and closing fifty connections. And that's just unacceptable in my opnion. Just as well, the lack of a SqlCommand paramter means I could not provide my own SqlParameter list to do parameterized queries, which would mean for me I could never do a WHERE clause, as I cannot add parameters.)

You could easily do this with something like the following:

public static T GetValue<T>(Command query)
    where T : IComparable, IConvertible, IEquatable<T>
{
    Object value = GetValue(query);
    if (Convert.IsDBNull(value))
        return GetDefaultValue<T>();
    return (T)Convert.ChangeType(value, typeof(T));
}

public static T GetDefaultValue<T>()
    where T : IComparable, IConvertible, IEquatable<T>
{
    if (typeof(T) == typeof(String))
        return (T)(object)String.Empty;
    return default(T);
}

private static Object GetValue(Command query)
{
    try
    {
        if (query.Connection == null)
            using (SqlConnection connection = new SqlConnection(ConnectionString))
            {
                connection.Open();
                return command.ExecuteScalar();
            }
        else
            return command.ExecuteScalar();
    }
    catch (Exception e)
    {
        LogQueryError(query, e);
        return DBNull.Value;
    }
}

This gives you expandability, with the maintainability and SQL injection protection at the client-level. (I assume the users of this class would be quite unhappy if you did nothing to help them protect against SQL injection attacks.)

You could always, for backwards compatibility, leave the GetValue<T>(string query) method in, and rewrite it just a tad:

public static T GetValue<T>(string query)
    where T : IComparable, IConvertible, IEquatable<T>
{
    Object value;
    using (SqlCommand command = new SqlCommand(query))
        value = GetValue(command);
    if (Convert.IsDBNull(value))
        return GetDefaultValue<T>();
    return (T)Convert.ChangeType(value, typeof(T));
}

Portability, maintainability, and it's dynamic enough to handle most any situation.

Lastly, for completeness, this would require another rewrite of the LogQueryError method:

protected static void LogQueryError(SqlCommand query, Exception e)
{
    log.Error(string.Format("Error while executing Query ({0}): {1}", query.CommandText, e.Message));
}

Additional Notes

As Malachi said, other things I would look at changing are the class name (DataBase is awfully broad), and the ConnectionString handling.

If you choose to implement both a method that takes a SqlCommand, and a method that takes a string (for backwards compatibility), you can remove the method that takes a string when you are ready to make a full transition to the SqlCommand method.

Do you want the entire application to have access to ConnectionString? I would think that you want to set how the connection string is changed. You should probably use a private property with a public get/set so that nothing else inadvertently changes the connection string of your Database object in a way you aren't expecting.

Database is a little broad for a class that only does a simple query. I think that you could be more specific with this class's name.