title: What is passing parameters to SQL and why do I need it?
body: <p>Beginner here:  </p>
  
  <p>In this <a href="https://stackoverflow.com/questions/3077770/how-do-i-execute-an-insert-using-sqlcommand">answer</a> to my question of how to insert data into SQL Server he mentioned passing parameters instead of string concatenation like I currently have.  </p>
  
  <p>Is this really necessary for security? If so, what exactly is passing parameters? When i google it I get a lot about stored procedures. Is that what I want, I do not know about stored procedures....yet.  </p>
  
  <p>If you can point me in the right direction, I would appreciate that.</p>
  
  <p>Thanks.  </p>
  
  <p><strong>EDIT:</strong>  </p>
  
  <p>Ok, here is what I got. It seems to update the database correctly and eventually I will change the hard coded ints to inputs from a label. Please confirm if how I did this is not vulnerable to any sql injection or hacks.  </p>
  
  <pre><code>using System;
  using System.Collections.Generic;
  using System.Linq;
  using System.Web;
  using System.Web.UI;
  using System.Web.UI.WebControls;
  using System.Web.Security;
  
  using System.Data;
  using System.Data.Sql;
  using System.Data.SqlClient;
  
  
  
  public partial class Stats : System.Web.UI.Page
  {
  
      public SqlDataReader DataReader;
      public SqlCommand Command;
      string queryString = ("INSERT INTO UserData (UserProfileID, ConfidenceLevel, LoveLevel, HappinessLevel) VALUES (@UID, @CL, @LL, @HL);");
      //string queryString = ("INSERT INTO UserData (UserProfileID, ConfidenceLevel, LoveLevel, HappinessLevel) VALUES ('a051fc1b-4f51-485b-a07d-0f378528974e', 2, 2, 2);"); 
  
      protected void Page_Load(object sender, EventArgs e)
      {
         LabelUserID.Text = Membership.GetUser().ProviderUserKey.ToString();
  
      }
  
      protected void Button1_Click(object sender, EventArgs e)
      {
  
          //connect to database
          MySqlConnection database = new MySqlConnection();
          database.CreateConn(); 
  
          //create command object
          Command = new SqlCommand(queryString, database.Connection);
  
          //add parameters. used to prevent sql injection
          Command.Parameters.Add("@UID", SqlDbType.UniqueIdentifier);
          Command.Parameters["@UID"].Value = Membership.GetUser().ProviderUserKey;
  
          Command.Parameters.Add("@CL", SqlDbType.Int);
          Command.Parameters["@CL"].Value = 9;
  
          Command.Parameters.Add("@LL", SqlDbType.Int);
          Command.Parameters["@LL"].Value = 9;
  
          Command.Parameters.Add("@HL", SqlDbType.Int);
          Command.Parameters["@HL"].Value = 9;
  
          Command.ExecuteNonQuery(); 
  
  
      }
  
  }
  </code></pre>