Detect parameters in dbCommand

Question

I have a function that accepts an SQL statement like this:

Public ExecuteReader(ByVal strSQL As String)
    Dim objCommand as New SQLCommand(strSQL)
End Public

The previous developer concatenated strings like this (prone to SQL injection, I know):

SELECT * FROM Person WHERE ID = " & intID & "

I am now using SQL parameters e.g. strSQL could now be

SELECT * FROM Person WHERE ID = @ID

The only option I believe is to have the calling function add the parameters and pass the parameter values to ExecuteReader i.e.

Public ExecuteReader(ByVal strSQL As String, ByVal params as dbParameter)

Is there an easier way of doing this?

user2694605 · Accepted Answer · 2013-12-08 13:49:15Z

1

I think the only way would be to use

addWithValue("@ID", value)

I don't think there's an easier way...

answered Dec 8, 2013 at 13:49

user2694605

Sign up to request clarification or add additional context in comments.

1 Answer 1