数据库中参数的使用

在SQL中的修改数据中参数的使用！

 private static SqlCommand GetCommand()

       {

           string strCnn =ConfigurationManager.ConnectionStrings["con"].ConnectionString;

           SqlConnection sqlcnn;

           sqlcnn = new SqlConnection(strCnn);

           //SqlCommand sqlcmm = new SqlCommand();

           //sqlcmm.Connection = sqlcnn;

           //sqlcmm.CommandText = "insert into ....";

           //SqlCommand sqlcmm = new SqlCommand("insert into ...",sqlcnn);

           return sqlcnn.CreateCommand();

 

       }

 

           SqlCommand sqlcmm = GetCommand();

           sqlcmm.CommandText = "update users set name=@name,password=@passwhere                uid=@uid";

           SqlParameter param = new SqlParameter();

           param.ParameterName = "@name";

           param.SqlDbType = System.Data.SqlDbType.NVarChar;

           param.Size = 8;

           param.Value = this.txtname.Text;

           sqlcmm.Parameters.Add(param);

 

           param = new SqlParameter("@pass", System.Data.SqlDbType.VarChar,16);

           param.Value = this.txtpass.Text;

           sqlcmm.Parameters.Add(param);

 

           param = new SqlParameter("@uid",System.Data.SqlDbType.VarChar, 6);

           param.Value = this.txtid.Text;

           sqlcmm.Parameters.Add(param);

 

           sqlcmm.Connection.Open();

           int i = sqlcmm.ExecuteNonQuery();

           sqlcmm.Connection.Close();

           Response.Write(i);