title: Using SqlParameter for security with C# ASP.NET and SQL Server 2008 R2
body: <p>I'm converting the following C# markup to use SqlParameter (I'm new to SqlParameter) in order to enhance security:</p>
  
  <pre><code>public static void EmptyTable(string TableToEmpty)
  {
      try
      {
          using (SqlConnection conn = new SqlConnection(DatabaseConnectionString))
          {
              using (SqlCommand cmd = new SqlCommand("TRUNCATE TABLE @prmTableToEmpty", conn))
              //using (SqlCommand cmd = new SqlCommand("TRUNCATE TABLE " + TableToEmpty, conn))
              {
                  cmd.Parameters.Add(new SqlParameter("@prmTableToEmpty", TableToEmpty));
                  cmd.Connection.Open();
                  cmd.ExecuteNonQuery();
              }
          }
      }
      catch
      {
          throw;
      }
  }
  </code></pre>
  
  <p>without the parameter use it works smoothly. However, with this syntax I get this exception:</p>
  
  <pre><code>    [SqlException (0x80131904): Incorrect syntax near '@prmTableToEmpty'.]
     System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection) +2073550
     System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) +5064508
     System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning() +234
     System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) +2275
     System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString) +215
     System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async) +987
     System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result) +162
     System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(DbAsyncResult result, String methodName, Boolean sendToPipe) +178
     System.Data.SqlClient.SqlCommand.ExecuteNonQuery() +137
     pjsql.EmptyTable(String TableToEmpty) in c:\website\App_Code\mySqlClass.cs:67
     _Default.btnEmptyTheTable_Click(Object sender, EventArgs e) in c:\website\Default.aspx.cs:83
     System.Web.UI.WebControls.Button.OnClick(EventArgs e) +118
     System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +112
     System.Web.UI.WebControls.Button.System.Web.UI.IPostBackEventHandler.RaisePostBackEvent(String eventArgument) +10
     System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) +13
     System.Web.UI.Page.RaisePostBackEvent(NameValueCollection postData) +36
     System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +5563
  </code></pre>
  
  <p>both line numbers mentioned contains the throw; command.</p>
  
  <p>I went through this: <a href="http://msdn.microsoft.com/en-us/library/4f844fc7%28v=vs.71%29.aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/4f844fc7(v=vs.71).aspx</a></p>
  
  <p>and tried this alternative syntax: <a href="http://www.csharp-station.com/Tutorials/AdoDotNet/Lesson06.aspx" rel="nofollow">http://www.csharp-station.com/Tutorials/AdoDotNet/Lesson06.aspx</a></p>
  
  <p>but with no luck.</p>
  
  <p>What am I missing?</p>