title: using stating for sqlcommand.executescalar
body: <p>I am using a <code>using</code> statement for validating a customer number.</p>
  
  <pre><code>using (SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString))
  {
      connection.Open();
  
      using (SqlCommand cmdCheck = new SqlCommand("SELECT COUNT(CUSTOMER_NO) FROM WEBSITE_CUSTOMERS WHERE UPPER(CUSTOMER_NO) = '" + strCustomer.Trim().ToUpper() + "';", connection))
      {
          int nExists = (int)cmdCheck.ExecuteScalar();
          if (nExists &gt; 0) 
              return true;
          else
              return false;
      }
  }
  </code></pre>
  
  <p>This is code previously advised to me on stackoverflow for checking preexisting records... it works great, but I would like to know if there's a way that I can use a parameter with it for the customer number since this variable is entered through the form, I want to protect it from injection. Where would I create the parameter for <code>cmdCheck</code> when its in a <code>using</code> statement like this?</p>