這個SQL查詢有什麼問題？

Question

string country,city,viewers,pay,gender,name,title,details; 
DateTime d1=DateTime.Parse(tbdate.Text); 
country=ddlcompany.SelectedItem.Text; 
city=tbcity.Text; 
viewers =ddlviewers.SelectedItem.Text; 
pay=ddlpayment.SelectedItem.Text; 
gender=ddlsex.SelectedItem.Text; 
name=tbadname.Text; 
title=tbadtitle.Text; 
details=tbaddetails.Text; 


SqlCommand cmd = new SqlCommand 
("insert into ADVERTISEMENT 
Adv_Category,Country,City,Strat_Date,No_of_Viewers,Adv_Payment_Way, 
Viewers_Gender,Adv_Name,Adv_Title,Adv_Details) 
values('SMS',country,city,d1,viewers,pay,gender,name,title,details)", con); 

Answer 1

這裏是問題：

values('SMS',country,city,d1,viewers,pay,gender,name,title,details) 

這將是更好地做到以下幾點：

values('SMS',@country,@city,@d1,@viewers,@pay,@gender,@name,@title,@details) 

並傳遞參數給SqlCommand。

var param = new SqlParam("@country"); 
param.Value = country; 
cmd.Parameters.Add(param);