From CodeProject:
Under normal circumstances, it is strongly recommended that you don't concatenate strings to produce an SQL Command, because of the risk of SQL Injection - and this is indeed a very good idea. But if you are inserting 1000 rows, it doesn't make much sense to issue 1000 ExecuteNonQuery instructions - as you would have to do to use an SqlCommand instance and Parametrised queries.
Tagged: #sql #databases #server #strings