As we discussed in the How query processing impacts plan reuse section on caching methods, the primary reason to parameterize queries is to ensure that query execution plans get reused. But why is this important and what other reasons might there be to use parameters?
The importance of parameters
Security
One reason to use parameterized queries is for security. Using a properly formatted parameterized query can protect against SQL injection attacks. A SQL injection attack is where a malicious user can execute database code (in this case, T-SQL) on a server by appending it to a data-entry field in the application. As an example, imagine we have an application that contains a form that asks the user to enter their name into...
