How to parameterize complex OleDB queries?
问题 I'm trying to refactor some code that is using strings concatenation for creating SQL commands (which makes it vulnerable for a SQL injection). Basically all I'm trying to do is to replace all the string sqlToExecute = String.Format(..) statements with a SQL command and a List of OleDB parameters. I understand how this can be done for simple cases like String.Format("Select * from myTable where id = {0}", id) . However, I could not find a set of good examples for more complex SQL queries.