sqlParameter的两种写法 以及存储过程还有sql语句（防注入）

SqlParamerter sp=new SqlParamerter[]{
new SqlParamerter("@id",id)
}

　　

SqlParameter[] sp = new SqlParameter[1];

sp[0] = new SqlParameter("@name", name);

　　-------------------------------------------------------------------------------

 public static object queryName(string name)
        {
            SqlParameter[] sp = new SqlParameter[1];
            sp[0] = new SqlParameter("@name", name);
            CommandType ct = CommandType.Text;
return Sqlhelper.ExecuteScalar("select programid from  program where programname=@name", sp, ct);
        }

　　

public static int savaIdea(string idea, int proid, int ndid)
        {
            SqlParameter[] sp = new SqlParameter[3];
            sp[0] = new SqlParameter("@idea", idea);
            sp[1] = new SqlParameter("@proid", proid);
            sp[2] = new SqlParameter("@ndid", ndid);
            CommandType ct = CommandType.StoredProcedure;
return Sqlhelper.ExecuteNonQuery("proc_saveIdea", sp, ct);
        }