Re: Passing an int to a query

[David]

Two reasons that I know of off-hand to use parameters.

1) They help prevent SQL injection attacks. By using parameters, you help prevent the user from being able to add inline script that can affect your database. It's not a cure-all, but it is another layer of protection.

2) Parameters take care of type-casting for you. Anybody who has tried getting DateTime fields to work from one database to another can attest to this. Each database that I've dealt with as of late has a different method for storing DateTime data, and without using parameters, you have to write a bunch of extra code to cast the data to make your program work. It's a pain.

I can write a program that deals with Microsoft SQL Server, and if I need to port it to MySQL (or vise versa) all I have to do is a couple of quick find/replace procedures for the class library name in my code, and voila, it works.

David