title: From what do sql parameters protect you?
body: <p>Parameters are used to protect you from malicious user input.</p>
  
  <p>But if the parameter expects a string, is it possible to write input that will be interpreted as sql, so malicious users can use things like 'DROP', 'TRUNCATE', etc...?</p>
  
  <p>Are there differences in protection between parameters in asp, asp.net, java and others?</p>
  
  <hr>
  
  <p>See also: <a href="https://stackoverflow.com/questions/306668/are-parameters-really-enough-to-prevent-sql-injections">Are parameters really enough to prevent SQL injections?</a></p>