title: Why do we always prefer using parameters in SQL statements?
body: <p>I am very new to working with databases. Now I can write <code>SELECT</code>, <code>UPDATE</code>, <code>DELETE</code>, and <code>INSERT</code> commands. But I have seen many forums where we prefer to write:</p>
  
  <pre><code>SELECT empSalary from employee where salary = @salary
  </code></pre>
  
  <p>...instead of:</p>
  
  <pre><code>SELECT empSalary from employee where salary = txtSalary.Text
  </code></pre>
  
  <p>Why do we always prefer to use parameters and how would I use them?</p>
  
  <p>I wanted to know the use and benefits of the first method. I have even heard of SQL injection but I don't fully understand it. I don't even know if SQL injection is related to my question.</p>