What does SqlCommand.Parameters.AddWithValue really do?

Question

What changes are SqlCommand.Parameters.AddWithValue()made with the request?

I expect:

• It replaces each character 'with '',

• If the value of the parameter is a string or something that needs to be converted to a string, it surrounds the value ', therefore, for example, it select * from A where B = @hellowill select * from A where B = 'hello world'.

• If the parameter value is something "safe", as a whole, it is inserted into the request as is, without quotes, so it select * from A where B = @onewill select * from A where B = 1.

Are there any other changes that I don't know about?

Answer 1

ADO.NET SqlClient ! - -.

, @param1 ... @paramN SQL Server / . SQL Server , sp_executesql.

, " SQL" - . , ADO.NET, SQL-.

Answer 2

, SqlParameterCollection, SQL Injection.

MSDN , , , . , , , Reflector , .