title: Confirmation of correct use of code to prevent SQL injection and correct use of the using statement
body: <pre><code>else if(updated_password == confirm_password)
  {
      old_user = textBox1.Text;
      old_pass = textBox2.Text;
      confirm_password = textBox4.Text;
  
      using (var old_connection = new MySqlConnection("server=localhost;user id=" + old_user + ";database=DB;password=" + old_pass))
      {
        old_connection.Open();
  
        string sql = "ALTER USER @user @'localhost' IDENTIFIED BY @newPass";
        MySqlCommand old_cmd = new MySqlCommand(sql, old_connection);
        old_cmd.Parameters.AddWithValue("@user", old_user);
        old_cmd.Parameters.AddWithValue("@newPass", confirm_password);
  
        old_cmd.ExecuteNonQuery();
  
        MessageBox.Show("Password changed successfully.", "Info", MessageBoxButtons.OK, MessageBoxIcon.Information);
     }
  }
  </code></pre>
  
  <p>Can someone please inform me if I got the malicious SQL injection sorted out by using the .Parameters.Add.. correctly and also that I am using the using statement correctly?</p>