How do I use parameters in C# SQL queries?

How do I use parameters in C# SQL queries?

You can use parameters in C# SQL queries to prevent SQL injection and improve performance. Use SqlCommand with parameters.

Can you show me a code example?

Sure! Here's a simple example:

using (SqlConnection conn = new SqlConnection(connectionString))
{
    string query = "SELECT * FROM Users WHERE UserId = @UserId";
    SqlCommand cmd = new SqlCommand(query, conn);
    cmd.Parameters.AddWithValue("@UserId", userId);
    conn.Open();
    SqlDataReader reader = cmd.ExecuteReader();
    // Process data
}

What if I want to insert data using parameters?

You can do that too! Here's an example for inserting data:

string insertQuery = "INSERT INTO Users (Name, Age) VALUES (@Name, @Age)";
SqlCommand insertCmd = new SqlCommand(insertQuery, conn);
insertCmd.Parameters.AddWithValue("@Name", name);
insertCmd.Parameters.AddWithValue("@Age", age);
insertCmd.ExecuteNonQuery();