学习asp.net之SQL语句查询效率和安全性

//设置sql语句

insertstr="insert into userinfo(name,password,email,phone,mobile,post,address)
values(``";
insertstr += this._name.trim()
;+ "``,``";
insertstr += this._password.trim() +"``,``";
insertstr += this._email.trim() +"``,``";
insertstr += this._phone.trim() +"``,``";
insertstr += this._mobile.trim() +"``,``";
insertstr += this._post.trim() +"``,``";
insertstr += this._address.trim() +"``)";

string strsql = "insert into sometable (c1 , c2 , c3 , ...) values(@c1 , @c2 ,
@c3,...)"
sqlcommand mycommand = new sqlcommand(strsql , myconn)
try
{
mycommand.parameters.add(new sqlparameters("@c1" , sqldatatype.varchar , 20)
mycommand.parameters["@c1"].value = this._name ;
....
//有几个加几个
....
}
catch(...)
...