title: How to add parameters to WebMatrix Database.Query?
body: <p>Using Database.Query has has made <a href="https://stackoverflow.com/a/11905249/1152809">a huge improvement</a> on readability in my code:</p>
  
  <pre><code>String Select = 'sp_getAllUsers';
  WebMatrix.Data.Database DB = WebMatrix.Data.Database.Open(MyConString);
  var data = DB.Query(Select);
  </code></pre>
  
  <p>I'd like to switch to a non-stored procedure query. The <a href="https://msdn.microsoft.com/en-us/library/webmatrix.data.database.query%28v=vs.111%29.aspx" rel="nofollow noreferrer">MSDN says there's an optional parameter to the Query Method</a>, <code>Object[]</code>, that can be passed as SQL parameters, however they don't have any further information about it.</p>
  
  <p>So I have two questions: </p>
  
  <ul>
  <li>How can I create a <code>Object[]</code>? </li>
  <li>Will adding parameters in this way prevent hacking threats, such as SQL Injection?</li>
  </ul>
  
  <p>Here's an abridged version of what I have tried:</p>
  
  <pre><code>Select = "Select * From Users Where first_name = "Foo" AND last_name = "Bar"
  
  // Like Javascript
  Object[] params = {"first_name" : "Foo"}, {"last_name" : "Bar"};
  
  // More Like What I think it will be
  Object[] Params = (String Name = "first_name", String First_Name = "Foo");
  
  var data = DB.Query(Select, params);
  </code></pre>
  
  <p>All the sources I've looked at only seem to reference <a href="https://stackoverflow.com/a/11905249/1152809">the old way</a>. <a href="https://stackoverflow.com/questions/26471744/webmatrix-database-query-with-custom-commandtimeout">This</a> is close, but he doesn't use the parameter parameter of the Query method.</p>