title: How do parameterized queries help against SQL injection?
body: <p>In both queries 1 and 2, the text from the textbox is inserted into the database. What's the significance of the parameterized query here?</p>
  
  <ol>
  <li><p>Passing <code>txtTagNumber</code> as a query parameter</p>
  
  <pre><code>SqlCommand cmd = new SqlCommand("INSERT INTO dbo.Cars " +"VALUES(@TagNbr);" , conn);
  cmd.Parameters.Add("@TagNbr", SqlDbType.Int);
  cmd.Parameters["@TagNbr"].Value = txtTagNumber.Text;
  </code></pre></li>
  <li><p>Converting <code>txtTagNumber</code> to an integer before constructing the query</p>
  
  <pre><code>int tagnumber = txtTagNumber.Text.ToInt16(); /* EDITED */
  INSERT into Cars values(tagnumber.Text); /* then is it the same? */
  </code></pre></li>
  </ol>
  
  <p>Also, here I would use Regular Expression validation to stop insertion of illegal characters.</p>