Parameterized Query for MySQL with C#

Question

I have the code below (I\'ve included what I believe are all relevant sections):

private String readCommand = \"SELECT LEVEL FROM USERS WHERE VAL_1 = ? AND V         


        

Answer 1

You need to use named parameters in your query. E.g.:

String readCommand = "SELECT LEVEL FROM USERS WHERE VAL_1 = ?param1 AND VAL_2 = ?param2";

Then, pass the parameter names when you instantiate your MySqlParameter objects like so:

m.Parameters.Add(new MySqlParameter("param1", val1));