[C#] SqlCommand and its Parameters

Why Parameters?

1. Reuse execution plans (of SQL Server 2008).
2. Protect from SQL injection.

Code Snippet
command.Parameters.Add("@ID", SqlDbType.VarChar, 1024).Value = "ID";