title: How does SQLParameter prevent SQL Injection?
body: <p>What exactly is going on in the background that makes it so <a href="http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlparameter.aspx" rel="noreferrer">SQLParameter</a> prevents SQL Inection attacks in a .NET Parameterized query?  Is it just stripping out any suspect characters or is there something more to it?</p>
  
  <p>Has anyone out there checked to see what actually gets to SQL Server when you pass malicious input?</p>
  
  <p>Related: <a href="https://stackoverflow.com/questions/4892027/can-you-use-a-sqlparameter-in-the-sql-from-statement/4892060#4892060">Can you use a SQLParameter in the SQL FROM statement?</a></p>