title: Why do we use SQLiteCommands instead of string.Format to compose SQL statements?
body: <p>Many tutorials I've seen compose SQL statements by using variables and <code>Parameters.Add</code>, like this:</p>
  <pre><code>public void updateStudent(String @studentID, String @firstName, String @lastName)
  {
      SQLiteCommand command = conn.CreateCommand();
      command.CommandText = &quot;UPDATE Students SET firstName = @firstName, lastName = @lastName WHERE studentID = @studentID&quot;;
      command.Parameters.Add(new SQLiteParameter(&quot;@studentID&quot;, @studentID));
      command.Parameters.Add(new SQLiteParameter(&quot;@firstName&quot;, @firstName));
      command.Parameters.Add(new SQLiteParameter(&quot;@lastName&quot; , @lastName));
      command.ExecuteNonQuery();
  }
  </code></pre>
  <p>Why don't we use</p>
  <pre><code>string.Format(&quot;Update Students SET firstName = '{0}', lastName = '{1}...&quot;, @firstName, @lastname)
  </code></pre>
  <p>instead?</p>