vb.net - How do I create a parameterized SQL query? Why Should I? -

i've heard "everyone" using parameterized sql queries protect against sql injection attacks without having vailidate every piece of user input.

how do this? automatically when using stored procedures?

so understanding non-parameterized:

cmdtext = string.format("select foo bar baz = '{0}'", fuz) 

would parameterized?

cmdtext = string.format("exec foo_from_baz '{0}'", fuz) 

or need somethng more extensive in order protect myself sql injection?

with command     .parameters.count = 1     .parameters.item(0).parametername = "@baz"     .parameters.item(0).value = fuz end 

are there other advantages using parameterized queries besides security considerations?

update: great article linked in 1 of questions references grotok. http://www.sommarskog.se/dynamic_sql.html

your exec example not parameterized. need parameterized queries (prepared statements in circles) prevent input causing damage:

';drop table bar;--

try putting in fuz variable (or don't, if value bar table). more subtle , damaging queries possible well.

here's example of how parameters sql server:

public function getbarfoobybaz(byval baz string) string     dim sql string = "select foo bar baz= @baz"      using cn new sqlconnection("your connection string here"), _         cmd new sqlcommand(sql, cn)          cmd.parameters.add("@baz", sqldbtype.varchar, 50).value = baz         return cmd.executescalar().tostring()     end using end function 

stored procedures credited preventing sql injection. however, of time still have call them using query parameters or don't help. if use stored procedures exclusively, can turn off permissions select, update, alter, create, delete, etc (just exec) application user account , protection way.