SqlParameter

Question

what is use of SqlParameter? Plz explain to me...

Zoran Horvat · Answer

It is the way to implement query parameterization. For example if you have a query like this: SELECT * FROM Person WHERE Name=@name Name column would be matched against a parameter value provided from the outside. Using parameters saves you from many bad things in database programming. Benefits from parameterized queries are: 1. Database engine compiles the statement only once rather than on every execution - This is because parameterized query is always the same only parameter values vary. 2. Parameters are strongly typed - For example if you are storing dates to database you don't have to bother with date format when writing the fixed query. 3. Parameters save you from SQL injection attacks. SQL injection is a dangerous thing and it works like this. If you wrote the query above in code as: string query = SELECT * FROM Person WHERE Name=' + name + '; and variable name is picked from the text box filled by the user then user might write this in the text box: '; DROP DATABASE Users; SELECT * FROM Person WHERE Name='hacker In that case your query would become: SELECT * FROM Person WHERE Name=''; DROP DATABASE Users; SELECT * FROM Person WHERE Name='hacker' And this query when executed would drop your database... It is syntaxically correct and it would execute. Zoran

Sunny Chan · Answer

Thanks.. Zoran and Jitendra

Jiteendra Sampathirao · Answer

hi sunny Sql parameter is represent a parameter to the SqlCommand and optionally its mapping to the Dataset columns. Refer this Link Link2