怎样把下面的非参数化查询sql查询改成参数化查询

Question

给你参考一下！
OleDbCommand insertCom=new OleDbCommand();
insertCom.CommandText="insert into insurance(name,specify,yearnumber,typeworkid,sumorwin) values(?,?,?,?,?) ";
insertCom.Parameters.Add(new OleDbParameter("@name",OleDbType.VarChar,100,"name"));
insertCom.Parameters.Add(new OleDbParameter("@specify",OleDbType.VarChar,100,"specify"));
insertCom.Parameters.Add(new OleDbParameter("@yearnumber",OleDbType.Integer,100,"yearnumber"));
insertCom.Parameters.Add(new OleDbParameter("@typeworkid",OleDbType.VarChar,50,"typeworkid"));
insertCom.Parameters.Add(new OleDbParameter("@sumorwin",OleDbType.VarChar,10,"sumorwin"));
insertCom.Parameters[0].Value=txtBox1.Text.Trim();
insertCom.Parameters[1].Value=txtBox2.Text.Trim();
insertCom.Parameters[2].Value=int.Parse(txtBox3.Text.Trim());
insertCom.Parameters[3].Value=typeworkid;
insertCom.Parameters[4].Value=cmBox2.Text;
                    
insertCom.Connection=oleCon;
if(oleCon.State==System.Data.ConnectionState.Closed)
{
oleCon.Open();
}
insertCom.ExecuteNonQuery();

Answer 1

string sql="select * from userid.users where id=@id";
objConn=new OleDbConnection(Constant.strConn);
objCmd  = new OleDbCommand(sql, objConn);
SqlParameter pid = new SqlParameter("@id",SqlDbType.VarChar);
pid.value = TextBoxName.Text;
objCmd.Parameter.Add(pid);try       //扑捉异常错误
{  
objConn.Open();
objReader  = objCmd.ExecuteReader();
while (objReader.Read())
{
strname=objReader["id"].ToString();
strpwd=objReader["pwd"].ToString();
}
objReader.Close(); } catch
{
Response.Write ("<script defer>alert(\"数据库错误！    \");</script>");
return;
} finally 
{ objConn.Close();
}