title: Add multiple SQL values with same parameterized query?
body: <p>I'm fairly new to SQL and trying to figure out the best way to add some predefined data.  I figured out from searching around here that I should used a parameterized command to avoid a sql injection attack which isn't a huge concern in this case but I would like to avoid the possibility and learn to do it right...  Anyway here is the code I have right now:</p>
  
  <pre><code>        using (SqlTransaction trans = connection.BeginTransaction())
          {
              foreach (IEnumerable&lt;string&gt; row in table.RowData)
              {
                  using (SqlCommand sql = new SqlCommand("INSERT INTO " + table.Title
                      + " (" + string.Join(", ", table.Headers)
                      + ") VALUES (" + string.Join(", ", table.Headers.Select(x =&gt; "@" + x)) + ");", connection, trans))
                  {
  
                      for (int i = 0; i &lt; table.Headers.Count(); i++)
                      {
                          if (string.IsNullOrEmpty(row.ElementAt(i)))
                          { sql.Parameters.AddWithValue("@" + table.Headers.ElementAt(i), DBNull.Value); }
                          else
                          { sql.Parameters.AddWithValue("@" + table.Headers.ElementAt(i), row.ElementAt(i)); }
                      }
                      sql.ExecuteNonQuery();
                  }
              }
              trans.Commit();
          }
  </code></pre>
  
  <p>This seems to work and all the data gets in there but it 'feels' inefficient to me.  I'm wrapping it in a transaction so there is only one commit, but it's creating the parameters every time and just setting different values for each row.</p>
  
  <p>Is there a way to make this use the same parameters but just set different values per row?  Or is this the best way to do this and I should not worry about it?</p>
  
  <p>Thanks in advance for any help you can give.</p>