title: AddWithValue sql injection safe? Why?
body: <p>I hope this is the right place to ask, how does <code>parameters.addwithvalue</code> work? I am thinking in a way to protect against SQL injection? I have been looking quite a lot on Stackoverflow, and a lot of people say "//Against sql injection". I have been using it blindly, but now that I have to hand in a paper about my assignment I need to explain why it is protection. I have been trying to find something on MSDN, found this one:</p>
  
  <p><a href="http://msdn.microsoft.com/en-us/library/ms161953%28SQL.105%29.aspx" rel="nofollow" title="SQL Injection">SQL injection</a> But it uses the <code>parameters.add</code>. I then read that they replace <code>.Add</code> with <code>.AddWithValue</code>, is that true? Any official on this then?</p>
  
  <p>So basically, anyone better in searching for some official paperwork that it protect against SQL injection? Or can tell me how it works?</p>
  
  <p>I am not trying to make you do my work, I just can't find it my self.</p>
  
  <p>I am using it like this:</p>
  
  <pre><code>using (SqlConnection conn = new SqlConnection(connectionString))
  using (var cmd = conn.CreateCommand())
  {
          conn.Open();
          String queryString = "DELETE FROM dbo.SecurityAccess WHERE Username = ' @Username ";
          cmd.CommandText = queryString;
          cmd.Parameters.AddWithValue("@Username", Username);
          cmd.ExecuteNonQuery();
  }
  </code></pre>