title: no value given fr one or more required parameters
body: <p>I'm trying to prevent SQL injections. Am I doing this right? (I'm using MS Access.) Should I still use <code>sqlparameter</code>?</p>
  
  <pre><code>OleDbParameter[] myparm = new OleDbParameter[2];
  myparm[0] = new OleDbParameter("@UserID", UserName.Text);
  myparm[1] = new OleDbParameter("@Password", encode);
  
  string queryStr = "SELECT * FROM TMUser WHERE UserID=@UserID AND Password=@Password";
  
  OleDbConnection conn = new OleDbConnection(_connStr);
  OleDbCommand cmd = new OleDbCommand(queryStr, conn);
  
  conn.Open();
  OleDbDataReader dr = cmd.ExecuteReader();
  </code></pre>