title: parameterized oracle query with enterprise library
body: <p>My .cs file contains this code</p>
  
  <pre><code>DbCommand dbc = 
      db.GetStoredProcCommand(
          string.Format(ConfigurationSettings.AppSettings["INSERT_TBLREPORTTYPE"]
                  , rtype, zoneid, name));
  </code></pre>
  
  <p>and my query in web.cofig is:</p>
  
  <pre><code>&lt;add key="INSERT_TBLREPORTTYPE" 
      value="INSERT INTO TBLREPORT(ID,TYPE,RELATIONID,ISACTIVE,NAME)    
              VALUES(SEQ_REPORT.NEXTVAL,{0},{1},0,{2}) "/&gt;
  </code></pre>
  
  <p>How to add parameter so that I can prevent sql injection on my site?</p>
  
  <p>I tried</p>
  
  <pre><code>db.AddInParameter(dbc, "NAME", DbType.String, name);
  db.AddInParameter(dbc, "RELATIONID", DbType.Int32, zoneid);
  db.AddInParameter(dbc, "TYPE", DbType.String, rtype);
  </code></pre>
  
  <p>and also</p>
  
  <pre><code>dbc.Parameters[0].DbType = DbType.String;
  dbc.Parameters[0].Value = name;
  dbc.Parameters[1].DbType = DbType.Int32;
  dbc.Parameters[1].Value = zoneid;
  dbc.Parameters[2].DbType = DbType.String;
  dbc.Parameters[2].Value = rtype;
  </code></pre>
  
  <p>None of them is working.  Can anyone give me suggestions regarding this????</p>