Parameterized SQL Queries in C#
by John • October 8, 2010 • Programming • 0 Comments
Introduction
Parameterizing your SQL queries is a technique that I mentioned I used in my code last post. Now, I’m not expert in SQL (I’m not even sure the UPDATE command I’m going to show is considered a ‘query’), but from I know from my class in software security that using this technique is a great way to protect against SQL injections. I’m not sure if they offer any performance benefits, but they are a lot cleaner to use when you are looping over data as opposed to concatenating strings to generate your query. And as I mentioned before, cleaner code = faster development time, so that’s always a huge plus in my book.…
Read more →