An SQL parameter is a typed placeholder whose value is supplied separately from an SQL statement’s command text. This separation helps prevent SQL injection when values are dynamic. section 4.3.1
Use parameters when constructing SQL with external or changing values:
- Avoid inserting variables directly into SQL strings, because unescaped content can alter the command. section 4.3.1
- Declare a parameter with a database type, then assign its value separately. section 4.3.1
- Let EF Core generate parameterized SQL when its configured data-access API is used. section 4.3.1
SqlDataAdapter myCommand = new SqlDataAdapter(
"UPDATE users SET notes = @notes", conn);
SQLParameter parm =
myCommand.SelectCommand.Parameters.Add("@notes",
SqlDbType.VarChar, 11);
Parm.Value = notes;
This listing shows a typed @notes placeholder receiving its value separately from the UPDATE command. section 4.3.1
