.NET(c#)Parameters

 

SqlCommand cmd = new SqlCommand("insert into users(username,realname,password,sex,email,question,answer) values (@USERNAME,@REALNAEM,@PWD,@SEX,@EMAIL,@QUESTION,@ANSWER)", conn);
            //为command加入参数并赋值
            //cmd.Parameters.Add("@ID", SqlDbType.Int).Value = int.Parse(txtUserId.Text.Trim());
            cmd.Parameters.Add("@USERNAME", SqlDbType.NVarChar).Value = txtUserName.Text.Trim();
            cmd.Parameters.Add("@REALNAEM", SqlDbType.NVarChar).Value = txtRealName.Text.Trim();
            cmd.Parameters.Add("@PWD", SqlDbType.NVarChar).Value = txtPwd.Text.Trim();
            cmd.Parameters.Add("@SEX", SqlDbType.NVarChar).Value = rblSex.SelectedItem.Text;
            cmd.Parameters.Add("@EMAIL", SqlDbType.NVarChar).Value = txtEmail.Text.Trim();
            cmd.Parameters.Add("@QUESTION", SqlDbType.NVarChar).Value = dplQuestion.SelectedItem.Text;
            cmd.Parameters.Add("@ANSWER", SqlDbType.NVarChar).Value = txtAnswer.Text.Trim();
            int v = cmd.ExecuteNonQuery();

c#中Parameters.Add

Add()将具有指定值的 DbParameter 项添加到 DbParameterCollection。

类似这样：
parameter = new SqlParameter("@name",SqlDbType.VarChar,10);

//定义SqlParameter对象,并指定类型
parameter.Value =txtName.Text;

//赋值
cmd.Parameters.Add(parameter);

//填入SqlCommand