高手指点ASP。NET中这样的两种插入数据方法有什么不一样？越具体越好

Question

高手指点ASP。NET中这样的两种插入数据方法有什么不一样？越具体越好
方法一：
SqlConnection conn = new SqlConnection(ConfigurationManager.AppSettings["DBConnectionString"]);//创建连接数据库对象
            SqlCommand insertCmd = new SqlCommand("insert into Users values(@userId,@userPwd,@userName,@userSex,@userBirth,@userPhone,@userMobilePhone,@userCode,@userAddress,@userEmail,@userQQ)", conn);
            insertCmd.Parameters.Add("@userId", SqlDbType.VarChar,15);   //为Command对象添加参数
            insertCmd.Parameters.Add("@userPwd", SqlDbType.VarChar, 20);
            insertCmd.Parameters.Add("@userName", SqlDbType.VarChar, 20);
            insertCmd.Parameters.Add("@userSex", SqlDbType.VarChar, 2);
            insertCmd.Parameters.Add("@userBirth", SqlDbType.DateTime, 8);
            insertCmd.Parameters.Add("@userPhone", SqlDbType.VarChar, 15);
            insertCmd.Parameters.Add("@userMobilePhone", SqlDbType.VarChar, 11);
            insertCmd.Parameters.Add("@userCode", SqlDbType.VarChar, 6);
            insertCmd.Parameters.Add("@userAddress", SqlDbType.VarChar, 200);
            insertCmd.Parameters.Add("@userEmail", SqlDbType.VarChar, 100);
            insertCmd.Parameters.Add("@userQQ", SqlDbType.VarChar, 20);
            insertCmd.Parameters["@userId"].Value = txtName.Text;         //给参数赋值
            insertCmd.Parameters["@userPwd"].Value=txtPwd.Text;
            insertCmd.Parameters["@userName"].Value=txtUname.Text;
            insertCmd.Parameters["@userSex"].Value=rltSex.SelectedItem.Text;
            insertCmd.Parameters["@userBirth"].Value=Convert.ToDateTime(ddlYear.SelectedValue+"-"+ddlMonth.SelectedValue+"-"+ddlDay.SelectedValue);
            insertCmd.Parameters["@userPhone"].Value=txtUtel2.Text;
            insertCmd.Parameters["@userMobilePhone"].Value = txtUtel3.Text;
            insertCmd.Parameters["@userCode"].Value=txtUzip.Text;
            insertCmd.Parameters["@userAddress"].Value=txtUaddr.Text;
            insertCmd.Parameters["@userEmail"].Value=txtUemail.Text;
            insertCmd.Parameters["@userQQ"].Value=txtUQQ.Text;
            try
            {
                conn.Open();      //打开连接
                int flag = insertCmd.ExecuteNonQuery();  //执行插入
                if (flag > 0)
                {
                    Response.Write("<script language=javascript>alert('成功完成注册！')</script>");
                }
                else 
                {
                    Response.Write("<script language=javascript>alert('注册失败！请检查输入是否符合要求')</script>");
                }
                Response.Redirect("Login.aspx");
            }
            catch (System.Exception ee)
            {
                Response.Write("<script language=javascript>alert('" + ee.Message.ToString() + "')</script>");
            }
            finally
            {
                conn.Close();        //关闭连接        
            }
-------------------------------------------------------------------------------------------------
方法二：            string sqlstr = "insert into [user] (userName,userPass,userPhone,userEmail,userQQ)values('" + TNAME.Text.Trim() + "','" + TPASS.Text.Trim() + "','" + TTEL.Text.Trim() + "','" + TEMAIL.Text.Trim() + "','" + TQQ.Text.Trim() + "') ";
            SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString);
            SqlCommand com = new SqlCommand(sqlstr,con);
            con.Open();
            int i = com.ExecuteNonQuery();
            con.Close();
            if (i > 0)
            {
                Response.Write("<script language=javascript>alert('恭喜，注册成功！')</script>");
                Response.Redirect("Default.aspx");
            }
            else
            {
                this.Label1.Text = "注册失败，请重新注册！";
            }

Answer 1

方法一有参数可以防止sql注入,比较好

Answer 2

第一种方法好.安全.如果嫌写代码麻烦,用一下类似codesmith等等的代码生成工具把这部分代码搞定就是了.反正数据库操作的代码我是不想写了.