title: How can I use SQL Server classes (e.g. SqlCommand) to prevent SQL injection WITHOUT database connection?
body: <p>I am currently checking StackOverflow for best practices about preventing SQL injection using C# code, and many of the answers include .NET SQL classes, like <code>SqlCommand</code>, <code>SqlDataAdapter</code>, ...</p>
  
  <p>The problem is that I have to use a proprietary middleware component to send the query to the database, and I can't find any way to use those classes without using a <code>SqlConnection</code>.</p>
  
  <p>Here is my example code:</p>
  
  <pre><code>SqlCommand sqlC = new SqlCommand("USP_MyProcedure");
  sqlC.CommandType = System.Data.CommandType.StoredProcedure;
  sqlC.Parameters.AddWithValue("@strRef", strRef);
  sqlC.Parameters.AddWithValue("@strCmd", strCmd);
  sqlC.Parameters.AddWithValue("@strParam", strParam);
  sqlC.Parameters.AddWithValue("@strDef", strDef);
  sqlC.Parameters.AddWithValue("@strWn", sWn);
  </code></pre>
  
  <p>The <code>SqlCommand</code> seems properly initialized, the <code>SqlParameterCollection</code> seems OK, but the property <code>SqlC.CommandText</code> returns only "USP_MyProcedure".</p>
  
  <p>If I use other classes to deal with my <code>SqlCommand</code>, for example:</p>
  
  <pre><code>SqlDataReader reader = sqlC.ExecuteReader();
  </code></pre>
  
  <p>I get an error because I have no connection to use:</p>
  
  <blockquote>
    <p>The connection property has to be initialized</p>
  </blockquote>
  
  <p>So, my questions are:</p>
  
  <ul>
  <li>Is there a way to use those .NET classes (or others?) to prepare my SQL queries to prevent SQL injections?</li>
  <li>If not, are there other .NET classes to prevent SQL injections or do I have to implement myself anti-SQL injection methods? Based on which best practice from your point of view?</li>
  </ul>
  
  <p>EDIT: looks like I have misunderstood how those classes work.</p>
  
  <p>Those classes do not prepare SQL statements "offline" and are designed to be used with a SqlConnection.</p>
  
  <p>But I can change the question to ask it from another point of view: <strong>are there .NET classes to prepare SQL statements "offline" against injection?</strong></p>