Parameters and SQL injection — ADO.NET — Connected & Disconnected Data Access

3. Parameters and SQL injection

Basic★ Must knowLesson 3 of 9

csharp

// ❌ NEVER — SQL injection: name = "x'; DROP TABLE Users;--"
var bad = new SqlCommand("SELECT * FROM Users WHERE Name = '" + name + "'", conn);

// ✅ Parameterised
var good = new SqlCommand("SELECT * FROM Users WHERE Name = @name", conn);
good.Parameters.Add("@name", SqlDbType.NVarChar, 50).Value = name;

Parameters send values separately from SQL text — they are never executed as code.
Prefer Parameters.Add(name, SqlDbType, size) over AddWithValue: AddWithValue infers the type (e.g. nvarchar(4000) for strings), which can cause implicit conversions that prevent index seeks (varchar column vs nvarchar parameter) and plan-cache bloat.
Pass DBNull.Value for nulls, not null.
Dynamic table/column names can't be parameters — validate against an allow-list or use QUOTENAME in SQL.