---
title: "Parameter Class in C#"  
description: "When writing database queries, we may configure our SQL statements using Parameters. In this blog we will discuss how to write our SQL statement wit"  
author: "Shankar M"  
published: 2013-02-24  
updated: 2014-09-18  
canonical: https://www.mindstick.com/blog/450/parameter-class-in-c-sharp  
category: "c#"  
tags: ["c#"]  
reading_time: 3 minutes  

---

# Parameter Class in C#

When writing [database queries](https://www.mindstick.com/forum/158717/how-can-you-optimize-database-queries-and-improve-performance-in-asp-dot-net-mvc), we may [configure](https://answers.mindstick.com/qa/51511/how-to-configure-client-and-repository-in-informatica-power-center) our SQL statements using [Parameters](https://www.mindstick.com/articles/87/passing-parameters-in-c-sharp). In this blog we will discuss how to write our SQL statement with parameters defined.\

Using [Parameter](https://www.mindstick.com/forum/773/parameterizing-an-sql-in-clause) helps guard against [SQL injection](https://www.mindstick.com/blog/227/sql-injection). The use of Parameterized SQL statements represents the basics of ADO .NET programming.

##### Parameter Creation

Creating a Parameter is as simple as declaring an instance of [SqlParameter](https://www.mindstick.com/forum/12652/how-to-set-typename-in-the-constructor-of-new-sqlparameter) Class. The SqlParameter class has [properties](https://www.mindstick.com/articles/23331/nootropics-7-different-types-and-their-unique-properties) associated with it. The properties of SqlParameter class are

ParameterName -Read/ Write property. Specifies the name of the SqlParameter

SqlDbType - Read/Write property. Specifies the size of the Parameter value

Size -This property specifies the direction of the Parameter such as Input, Output or InputOutput. Size is read/write property

Direction -This property maps a column from [DataTable](https://www.mindstick.com/blog/195/datatable-in-ado-dot-net) to the Parameter.

Value - This read/write property specifies the value that is passes to the parameter defined in the command

##### Coding Parameterized SQL Statement

```
using System;using System.Collections.Generic;using System.ComponentModel;using System.Data;using System.Drawing;using System.Linq;using System.Text;using System.Data.SqlClient;using System.Windows.Forms;using System.Configuration; namespace CSharpLearnings{    public partial class FrmParameterClass : Form    {        public FrmParameterClass()        {            InitializeComponent();        }         private void btCancel_Click(object sender, EventArgs e)        {            this.Close();        }         private void btLoad_Click(object sender, EventArgs e)        {            SqlConnection conn = new SqlConnection();            SqlDataReader reader;            SqlParameter EmpNoParam;            SqlParameter JobParam;             conn.ConnectionString = ConfigurationManager.ConnectionStrings["ConnString"].ConnectionString;             SqlCommand cmd = new SqlCommand();            cmd.CommandText = @"SELECT EMPNO,ENAME,JOB,MGR,HIREDATE,SAL,COMM,DEPTNO FROM EMP                                 WHERE EMPNO =@EMPLOYEENO and JOB = @JOBDESC";            cmd.Connection = conn;             EmpNoParam = new SqlParameter();            EmpNoParam.ParameterName = "@EMPLOYEENO";            EmpNoParam.SqlDbType = SqlDbType.Int;            EmpNoParam.Size = 10;            EmpNoParam.Direction = ParameterDirection.Input;            EmpNoParam.Value = 8957;              JobParam = new SqlParameter();            JobParam.ParameterName = "@JOBDESC";            JobParam.SqlDbType = SqlDbType.VarChar;            JobParam.Size = 20;            JobParam.Direction = ParameterDirection.Input;            JobParam.Value = "ENGINEER";             cmd.Parameters.Add(EmpNoParam);            cmd.Parameters.Add(JobParam);             cmd.Connection.Open();             reader = cmd.ExecuteReader(CommandBehavior.CloseConnection);                                    DataTable dt = new DataTable();            dt.Load(reader);             dgDetails.DataSource =dt;             cmd.Dispose();            conn.Dispose();        }    }}
```

The program receives Employee No and [Job Description](https://yourviews.mindstick.com/view/82240/social-media-strategist-job-description) as Input. The Parameters are created by instantiating the SqlParameter class and by specifying the object properties name, type, size, direction and value for each object.

We add the parameters to the [command object](https://answers.mindstick.com/qa/116279/explain-the-executenonquery-executescalar-and-executereader-methods-of-the-command-object) by calling the Add () Method of the Parameter collection.

The result of executing this code gets the result that matches the Employee No and Job Desc.

http://tempuri.org?link=new

Alternatively, you can add the Parameters to the Command object by calling the AddWithValue() Method too,

cmd.Parameters.AddWithValue("@EMPLOYEENO", 8957);

cmd.Parameters.AddWithValue("@JOBDESC", "ENGINEER");

If you think of creating SqlParameter[] array class then, we slighty modify our code as this

```
            SqlParameter[] sqlParameters = new SqlParameter[2];            sqlParameters[0] = new SqlParameter("@EMPLOYEENO",SqlDbType.Int);            sqlParameters[0].Value = Convert.ToInt32(8957);            sqlParameters[1] = new SqlParameter("@JOBDESC",SqlDbType.VarChar);            sqlParameters[1].Value = Convert.ToString(“ENGINEER”);
```

And, you can add the Parameters to the Command object by Invoking

myCommand.Parameters.AddRange(sqlParameters);

Thanks for Reading.

---

Original Source: https://www.mindstick.com/blog/450/parameter-class-in-c-sharp

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.