I'm using the SqlCommand object to read from/write to my database. I know that using SQL commands like below could lead to trouble:
Select * from myTable where tableId = '" + tableID + "'";
Instead, I've been using the preferred method of commands like:
Select * from myTable where tableId = @Table_ID";
Then create my parameters:
sqlCommand.Parameters.Add("@Table_ID", SqlDbType.VarChar, 50).Value = tableID;
I have two questions:
Is the order that I add my parameters to the
SqlCommandobject important?Do I need to add my
SqlCommand.CommandTextstring before I add my parameters?
I've always added my CommandText first and then added my parameters in order that they are used in the SQL string, but there are times where I would like to select from two different SQL strings (example: insert vs. update), but then add all the parameters after the "If" statement instead of nesting them inside it.