• Roy Cross (5/9/2007)


    Found it. For anyone else who may be interested...

    ' Add the input parameter and set its properties.

    Command.Parameters.Add("@SKU", SqlDbType.VarChar).Value = SKU

    Command.Parameters.Add("@Price", SqlDbType.Float).Value = Price

    Command.Parameters.Add("@RC", SqlDbType.TinyInt).Direction = ParameterDirection.Output

    Remember .Add has multiple overrides one of which is accepting a SQLParameter object, I will commonly do this (mostly from habit more than anything).

    cmdSQL.Parameters.Add(new SqlParameter("@Employee_ID",SqlDbType.VarChar,10,ParameterDirection.Input,false,0,0,"Employee_ID",DataRowVersion.Proposed,txtEmployeeID.Text.ToString()));

    But commonly overlooked point of parameters are dynamic SQL statements. You can build the SQL string using @[Name] for the parameter position and can use parameters to control data validation as well as protection against injection attacks. Which if you plan to use dynamic SQL this is what I suggest you do versus build in a Stored Procedure.

    This is a nice simple article but really lacks the impact of describing SqlParameter as it should.