The .NET Framework data providers handle naming and specifying parameters and parameter placeholders differently. This syntax is tailored to a specific data source, as described in the following table.
Data provider
|
Parameter naming syntax
|
|---|
SqlClient
|
Uses named parameters in the format @parametername.
|
OracleClient
|
Uses named parameters in the format :parmname (or parmname).
|
OleDb
|
Uses positional parameter markers indicated by a question mark (?).
|
Odbc
|
Uses positional parameter markers indicated by a question mark (?).
|
The factory model is not helpful for creating parameterized DbCommand and DbDataAdapter objects. You will need to branch in your code to create parameters that are tailored to your data provider.
Security Note: |
|---|
Avoiding provider-specific parameters altogether by using string concatenation to construct direct SQL statements is not recommended for security reasons. Using string concatenation instead of parameters leaves your application vulnerable to SQL injection attacks.
|