Column provides the parameters for parameterized command , and the 列為參數(shù)化命令提供參數(shù),
Object contains a parameterized command , the commands for the 對(duì)象是否包含參數(shù)化命令,都始終執(zhí)行
Parameters changes are propagated to the subscriber using parameterized commands 使用參數(shù)化命令將更改傳播給訂閱服務(wù)器。
Parameterized commands guard against a sql injection attack by ensuring that values received from an external source are passed as values only , and not part of the transact - sql statement 但是,即使大小足以接受惡意的transact - sql片斷,該片斷也只是作為值的一部分對(duì)待,而不會(huì)作為可執(zhí)行的transact - sql代碼對(duì)待。
Use parameterized commands using parameterized commands helps guard against sql injection attacks , in which an attacker " injects " a command into a sql statement that compromises security on the server 該參數(shù)定義為大小為5個(gè)字符,所以,在參數(shù)添加到命令中時(shí),如果textbox控件中提交的字符串值超過(guò)5個(gè)字符,將引發(fā)異常。
Stored procedure if the command contains parameters , which provides a performance benefit . as a result , if a command affecting the state of the connection is included in a non - parameterized command , it modifies the state of the connection for all subsequent commands executed while the connection is open Net framework 1 . 1版以及更高版本中,如果命令含有參數(shù),則executereader只在sp _ executesql存儲(chǔ)過(guò)程的上下文中執(zhí)行該命令,因?yàn)檫@樣可以提高性能。