You need to rewrite the following code to use a SqlParameter:

SqlConnection conn = new SqlConnection("Persist Security Info=False;"+
"Integrated Security=SSPI;database=northwind;server=dataServer");
string commandText = string.Format("SELECT * FROM Customers WHERE LastName='{0}'",
txtBoxLastName.Text);
SqlCommand cmd = new SqlCommand(commandText, conn);

Which code segment should you use?

Posted by Rajkatie on 8/31/2012 | Category: ADO.NET Interview questions | Views: 3021 | Points: 40

Select from following answers:

string commandText = "SELECT * FROM Customers WHERE LastName=@LastName"; SqlCommand cmd = new SqlCommand(commandText, conn); cmd.Parameters.Add("@LastName",txtBoxLastName.Text);
string commandText = "SELECT * FROM Customers WHERE LastName=@LastName"; SqlCommand cmd = new SqlCommand(commandText, conn); cmd.Parameters.Add("@LastName");
string commandText = "SELECT * FROM Customers WHERE LastName='{0}'"; SqlCommand cmd = new SqlCommand(commandText, conn); cmd.Parameters.Add("0", txtBoxLastName.Text)
All Above