在对数据库的操作中使用parameters

string conStr = "User Id=scott;Password=tiger;Data Source=oracle";
// Create the OracleConnection
OracleConnection con = new OracleConnection(conStr); con.Open();
// Create the OracleCommand
OracleCommand cmd = new OracleCommand(); cmd.Connection = con;

// Create OracleParameter
OracleParameter [] prm = new OracleParameter[3];

// Bind parameters
prm[0] = cmd.Parameters.Add("paramEmpno", OracleDbType.Decimal, 1234,
ParameterDirection.Input);

prm[1] = cmd.Parameters.Add("paramEname", OracleDbType.Varchar2,
"Client", ParameterDirection.Input);

prm[2] = cmd.Parameters.Add("paramDeptNo", OracleDbType.Decimal,
10, ParameterDirection.Input);

cmd.CommandText = "insert into emp(empno, ename, deptno) values(:1, :2, :3)";

cmd.ExecuteNonQuery();

// Remove OracleParameter objects from the collection
cmd.Parameters.Clear();

// Dispose OracleCommand object
cmd.Dispose();

// Close and Dispose OracleConnection object
con.Close();
con.Dispose();