c#SQL参数 防注入 parameter

public SqlCommand SqlCmd(string Cmd, string[] ColumnMode, SqlDbType[] ColumnType, string[] ColumnContent, SqlConnection conn,bool run)
        {
            
            conn.Open();
            SqlCommand cmd = new SqlCommand();
            SqlParameter myPrte = new SqlParameter();
            cmd.Connection = conn;
            cmd.CommandText = Cmd;
            for (int i = 0; i < ColumnMode.Length; i++)
            {
                myPrte = new SqlParameter(ColumnMode[i],ColumnType[i]);
                switch(ColumnType[i])
                {
                    case SqlDbType.Int:
                        myPrte.Value = int.Parse(ColumnContent[i]);
                        break;

                    case SqlDbType.Text:
                        myPrte.Value = ColumnContent[i];
                        break;
                }
                cmd.Parameters.Add(myPrte);
                
                
                
            }
            if (run)
            {
                cmd.ExecuteNonQuery();
                return cmd;
            }
            else
            {
                return cmd;
            }


            

        }

 

 

 

 

//////////////////////////////////////////////////

 

 

 

 private void database()
    { 

        string[]        strMode;
        SqlDbType[]     strType;
        string[]        strContent;
        strMode=new string[]{"@id","@pwd"};
        strType=new SqlDbType[]{SqlDbType.Text,SqlDbType.Text};
        strContent=new string[]{this.TextBox1.Text,this.TextBox2.Text};
        sqlobj.SqlCmd("INSERT INTO testtable (testchar,testname) VALUES(@id,@pwd)",strMode,strType,strContent,sqlobj.SqlConn(),true);
    }