我在许多教程中看到,通过使用变量和Parameters.Add来构造sql语句
public void updateStudent(String @studentID,String @firstName,String @lastName)
{
sqliteCommand command = conn.CreateCommand();
command.CommandText = "UPDATE Students SET firstName = @firstName,lastName = @lastName WHERE studentID = @studentID";
command.Parameters.Add(new sqliteParameter("@studentID",@studentID));
command.Parameters.Add(new sqliteParameter("@firstName",@firstName));
command.Parameters.Add(new sqliteParameter("@lastName",@lastName));
command.ExecuteNonQuery();
}
为什么我们不用
string.Format("Update Students SET firstName = '{0}',lastName = '{1}...",@firstName,@lastname)
任何好处？