sqlparameter用途

/// <summary>
  /// 单条记录的插入操作
  /// </summary>
  /// <param name="strtablename">表名</param>
  /// <param name="strcolumn">列名组</param>
  /// <param name="strvalue">值组</param>
  public static void insert(string strtablename, string[] strcolumn, object[] strvalue)
  {
   factory factory = factory.getinstance();
   abstractdbfactory abstractdbfactory = factory.createinstance();
   idbconnection concretedbconn = abstractdbfactory.createconnection();
   concretedbconn.connectionstring = abstractdbfactory.getconnectionstring();   
   concretedbconn.open();
   idbcommand concretedbcommand = abstractdbfactory.createcommand();
   idbtransaction concretedbtrans = abstractdbfactory.createtransaction(concretedbconn);
   concretedbcommand.connection = concretedbconn;
   concretedbcommand.transaction = concretedbtrans;
   try
   {
    string strsql = "insert into " + strtablename + " (";
    for(int i = 0; i < strcolumn.length - 1; i++)
    {
     strsql += (strcolumn[i] + ", ");
    }
    strsql += (strcolumn[strcolumn.length - 1] + ") values ('");
    for(int i = 0; i < strvalue.length - 1; i++)
    {
     strsql += (strvalue[i] + "', '");
    }
    strsql += (strvalue[strvalue.length - 1] + "')");
    concretedbcommand.commandtext = strsql;
    concretedbcommand.executenonquery();
    concretedbtrans.commit();
   }
   catch
   {
    concretedbtrans.rollback();
    throw;
   }
   finally
   {
    concretedbconn.close();
   }   
  }

  /// <summary>
  /// 批量记录的插入操作,即可一次向多张表中插入不同的批量记录
  /// </summary>
  /// <param name="ds">批量记录组成的dataset,dataset中的各个datatable名为表名,各datatable中的datacolumn名为列名</param>
  public static void insertset(ref dataset ds)
  {
   factory factory = factory.getinstance();
   abstractdbfactory abstractdbfactory = factory.createinstance();
   idbconnection concretedbconn = abstractdbfactory.createconnection();
   concretedbconn.connectionstring = abstractdbfactory.getconnectionstring();   
   concretedbconn.open();
   idbcommand concretedbcommand = abstractdbfactory.createcommand();
   idbtransaction concretedbtrans = abstractdbfactory.createtransaction(concretedbconn);
   concretedbcommand.connection = concretedbconn;
   concretedbcommand.transaction = concretedbtrans;
   try
   {
    foreach(datatable dt in ds.tables)
    {
     foreach(datarow dr in dt.rows)
     {
      string strsql = "insert into " + dt.tablename + " (";
      for(int i = 0; i < dt.columns.count - 1; i++)
      {
       strsql += (dt.columns[i].caption + ", ");
      }
      strsql += (dt.columns[dt.columns.count - 1].caption + ") values ('");
      for(int i = 0; i < dt.columns.count - 1; i++)
      {
       strsql += (dr[i] + "', '");
      }
      strsql += (dr[dt.columns.count - 1] + "')");
      concretedbcommand.commandtext = strsql;
   concretedbcommand.executenonquery();
     }
    }
    concretedbtrans.commit();
   }
   catch
   {
    concretedbtrans.rollback();
    throw;
   }

   finally
   {
    concretedbconn.close();
   }   
   concretedbcommand.executenonquery();
     }
    }
    concretedbtrans.commit();
   }
   catch
   {
    concretedbtrans.rollback();
    throw;
   }

   finally
   {
    concretedbconn.close();
   }