傑特_資訊手札

使用Parameter 最主要的原因是為了防止SQL Injection

SqlConnection conn = new SqlConnection("");
conn.ConnectionString = System.Configuration.ConfigurationManager.ConnectionStrings["ApplicationServices"].ConnectionString;
string strSql = "insert into Table (Name,Id)";
strSql += "VALUES (@Name, @Id)";
conn.Open();
SqlCommand sqlcom = new SqlCommand(strSql, conn);
sqlcom.Parameters.AddWithValue("@Name", Name);
sqlcom.Parameters.AddWithValue("@Id", Id);
SqlDataReader sqldr = sqlcom.ExecuteReader();
sqldr.Close();
conn.Close();