title: SQL Injection Prevention in .NET
body: <p>I typically write my SQL as so in .NET</p>
  
  <pre><code>sql.Append("SELECT id, code, email FROM mytable WHERE variable = @variable ");
  </code></pre>
  
  <p>Then do something like this:</p>
  
  <pre><code>using (SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings[ConfigurationManager.AppSettings["defaultConnection"]].ConnectionString))
  {
      using (SqlCommand myCommand = new SqlCommand(sql.ToString(), conn))
      {
          myCommand.Parameters.AddWithValue("@variable", myVariableName");
          ...
  </code></pre>
  
  <p>But should I also do this addParameter when the data I got comes directly from the database like so?</p>
  
  <pre><code>likesql.Append(string.Format("SELECT group_id, like_text FROM likeTerms ORDER BY group_id ASC "));
  
  DataTable dtLike = SqlHelper.GetDataTable(likesql.ToString());
  
  foreach (DataRow dr in dtLike)
  {
      buildsql.Append(".... varId = " + dr["group_id"].ToString() + "...");
  
      ...
  </code></pre>
  
  <p>Is this acceptable? What is best practice?</p>