title: Does LINQ's ExecuteCommand provide protection from SQL injection attacks?
body: <p>I've got a situation where I need to use LINQ's ExecuteCommand method to run an insert.</p>
  
  <p>Something like (simplified for purposes of this question):</p>
  
  <pre><code>object[] oParams = { Guid.NewGuid(), rec.WebMethodID };
  
  TransLogDataContext.ExecuteCommand (
  "INSERT INTO dbo.Transaction_Log (ID, WebMethodID) VALUES ({0}, {1})",
  oParams);
  </code></pre>
  
  <p>The question is if this is SQL injection proof in the same way parameterized queries are?</p>