title: How can I pass parameters to a pass-through query in c#?
body: <p>I have a C# program that uses <code>OPENQUERY()</code> to select from a linked server. This pass-through query takes in a parameter. To guard against SQL injection, I would like to pass this parameter in a manner similar to <code>SqlCommand.Parameters.AddWithValue</code>, however <code>OPENQUERY()</code> does not accept variables.</p>
  
  <p>So far, I have been using SqlCommand to pass parameters to queries run against tables in a SQL Server. However I also need to access the linked server which is Oracle. Is there any way to add in this parameter without concatenating it as a string?</p>
  
  <pre><code>string query = "SELECT * FROM OPENQUERY(linked_server, 
  'SELECT * FROM User.Table WHERE col1 = @parameter1 ')";
  </code></pre>
  
  <p>EDIT:
  I don't have permissions to create stored procedures on the remote Oracle server. So executing Sp_executesql on a stored procedure doesn't seem like the immediate answer for me. </p>