When working with data, you'll often want to filter results based on some criteria.�Typically, this is done by accepting input from a user and using that input to form a SQL query.

Don't ever build a query this way!�The input variable, inputCity, is typically retrieved from a TextBox control on either a Windows form or a Web Page.�Anything placed into that TextBox control will be put into inputCity and added to your SQL string.�This situation invites a hacker to replace that string with something malicious. In the worst case, you could give full control of your computer away.

Using parameterized queries is a three step process:

1. Construct the SqlCommand command string with parameters.

2. Declare a SqlParameter object, assigning values as appropriate.

3. Assign the SqlParameter object to the SqlCommand object's Parameters property.

he first step in using parameters in SQL queries is to build a command string containing parameter placeholders. These placeholders are�filled in with actual parameter values when the SqlCommand executes.�Proper syntax of a parameter is to use an '@' symbol prefix on the parameter name as shown below: