title: How do I create a parameterized SQL query? Why Should I?
body: <p>I've heard that "everyone" is using parameterized SQL queries to protect against SQL injection attacks without having to vailidate every piece of user input.</p>
  
  <p>How do you do this?  Do you get this automatically when using stored procedures?</p>
  
  <p>So my understanding this is non-parameterized:</p>
  
  
  
  <pre class="lang-vb prettyprint-override"><code>cmdText = String.Format("SELECT foo FROM bar WHERE baz = '{0}'", fuz)
  </code></pre>
  
  <p>Would this be parameterized?</p>
  
  <pre class="lang-vb prettyprint-override"><code>cmdText = String.Format("EXEC foo_from_baz '{0}'", fuz)
  </code></pre>
  
  <p>Or do I need to do somethng more extensive like this in order to protect myself from SQL injection?</p>
  
  <pre class="lang-vb prettyprint-override"><code>With command
      .Parameters.Count = 1
      .Parameters.Item(0).ParameterName = "@baz"
      .Parameters.Item(0).Value = fuz
  End With
  </code></pre>
  
  <p>Are there other advantages to using parameterized queries besides the security considerations?</p>
  
  <p>Update:  This great article was linked in one of the questions references by Grotok.
  <a href="http://www.sommarskog.se/dynamic_sql.html" rel="noreferrer">http://www.sommarskog.se/dynamic_sql.html</a></p>