title: Parameterized SQL in C# .Net
body: <p>If I have code like so:</p>
  
  <pre><code>public T ExecuteQuery&lt;T&gt;(Func&lt;IDataReader, T&gt; getResult, string query, params IDataParameter[] parameters)
  {
          using (SqlConnection conn = new SqlConnection(this.DefaultConnectionString))
          {
              conn.Open();
  
              // Declare the parameter in the query string
              using (SqlCommand command = new SqlCommand(query, conn))
              {
                  foreach (var parameter in parameters)
                  {
                      command.Parameters.Add(parameter);
                  }
  
                  command.Prepare();
  
                  using (SqlDataReader dr = command.ExecuteReader())
                  {
                      return getResult(dr);
                  }
              }
          }
      }
  
      public string GetMySpecId(string dataId)
      {
          return ExecuteQuery(
              dr =&gt;
              {
                  if (dr.Read())
                  {
                      return dr[0].ToString();
                  }
  
                  return string.Empty;
              },
              @"select ""specId"" from ""MyTable"" where ""dataId"" = :dataId",
              new SqlParameter("dataId", dataId));
      }
  }
  </code></pre>
  
  <p>How do I ensure that the </p>
  
  <pre><code>new SqlParameter("dataId", dataId)); 
  </code></pre>
  
  <p>piece of code is passing in a text or maybe an integer? Also how does the <code>@"select..."</code> actually work as I'm familiar to:</p>
  
  <pre><code> select id from mytable where dataId = @dataID;
  </code></pre>