title: What is the better way of making an SQL statement in Visual Studio?
body: <p>I was looking up how to insert into my database via sql and I noticed the way I had seen a person do an sql statement was different from the way I had done it and and now I'm wondering which way is better.</p>
  
  <p>An example of what I had done in a previous (select) statement.</p>
  
  <pre><code>SqlConnection conn = new SqlConnection(Variables.Default.sqlConString);
  conn.Open();
  string builtCmd = Variables.Default.returnUserNameSql1 + usersInput + Variables.Default.returnUsernameSql2;
  SqlCommand cmd = new SqlCommand(builtCmd, conn);
  
  usersInput is a string.
  Variables.Default.returnUserNameSql1 = SELECT [Username] from [dbo].[LoginDetails] WHERE [Username] = '
  returnUsernameSql2 = '
  </code></pre>
  
  <p>What I have seen online (not my query):</p>
  
  <pre><code>cmd.CommandText = "INSERT INTO klant(klant_id,naam,voornaam) VALUES(@param1,@param2,@param3)";
  
  cmd.Parameters.Add(new SqlParameter("@param1", klantId));
  cmd.Parameters.Add(new SqlParameter("@param2", klantNaam));
  cmd.Parameters.Add(new SqlParameter("@param3", klantVoornaam));
  </code></pre>
  
  <p>Is the use of the Parameters function (?) better? If so in what way?</p>
  
  <p>Thanks for your time.</p>
  
  <p>I modified my original query thanks to the help of some of the comments here. I'll post it if anyone's interested:</p>
  
  <pre><code>using (SqlConnection conn = new SqlConnection(Variables.Default.sqlConString))
                  {
                      conn.Open();
                      using (SqlCommand cmd = new SqlCommand(Variables.Default.returnUserNameSql, conn))
                      {
                          cmd.Parameters.Add(new SqlParameter(Variables.Default.param1, usersInput));
                          SqlDataReader reader = cmd.ExecuteReader();
                          usernameTaken = reader.Read();
                          cmd.Dispose();
                      }
                      conn.Close();
                  }
  </code></pre>