I am using parameterized queries like this to avoid sql injection,but is there any better and simple way??below is my code
string sql="insert into emp values(@empid,@name)";
SqlConnection con1 = new SqlConnection(con);
con1.Open();
SqlCommand cmd = new SqlCommand(sql,con1);
int id =Convert.ToInt32(TextBox1.Text);
string name = TextBox2.Text;
cmd.Parameters.Add("@empid", SqlDbType.Int).Value = id;
cmd.Parameters.Add("@name", SqlDbType.VarChar, 50).Value = name;
cmd.ExecuteNonQuery();
con1.Close();
If there is some other simple way please help me with that,thanks.
...
Go to the complete details ...