title: Parametized SQL Query with unlimited parameters
body: <p>I've heard of parametized sql queries a long time ago but I never really gave any attention to it as I'm used to writing full sql statements. I know it improves security against sql injection so now might be a very good time to adapt change even if it's too late. I got this one from this site <a href="http://www.codinghorror.com/blog/2005/04/give-me-parameterized-sql-or-give-me-death.html" rel="nofollow">http://www.codinghorror.com/blog/2005/04/give-me-parameterized-sql-or-give-me-death.html</a>. So all credits go to the author. I've noticed all examples of parametized sql queries have paremeter count limitations. An example is the one shown below.</p>
  
  <pre><code>SqlConnection conn = new SqlConnection(_connectionString);
  conn.Open();
  string s = "SELECT email, passwd, login_id, full_name FROM members WHERE email = @email";
  SqlCommand cmd = new SqlCommand(s);
  cmd.Parameters.Add("@email", email);
  SqlDataReader reader = cmd.ExecuteReader();
  </code></pre>
  
  <p>This is just equivalent to </p>
  
  <pre><code>SELECT email, passwd, login_id, full_name FROM members WHERE email = 'x';
  </code></pre>
  
  <p>I've learned programming all on my own through reading online tutorials and I really got nobody to help me on this. The reason I got stuck with full sql statement queries is the fact that I can't figure out how to do parametized sql queries with unlimited parameters. Is there any way to do this? The example only accepts 1 parameter which is the 'email' field. And it selects 4 fields from the given sql statement. My question is... is there any way we can do parametized sql queries with 5, 6, 7, or 100 selected fields, as well as the conditions under the WHERE clause? If this is possible, it will be particularly helpful when using INSERT statement. Thank you very much.</p>
  
  <p>This example is in C#, but any VB.NET or same C# implementations are greatly appreciated. Thanks.</p>