sql参数化

 public bool IsInsert(string userName, string password, string remark, string mail, int departId, int power)
 {
 string sql = "insert into S_Admin(UserName,Password,Remark,Mail,DepartId,Power)values(@UserName,@Password,@Remark,@Mail,@DepartId,@Power)";
 SqlConnection connection = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings[""].ToString());
 SqlCommand command = new SqlCommand(sql, connection);
 command.Parameters.Add("@UserName",SqlDbType.NVarChar, 60).Value = userName;
 command.Parameters.Add("@Password", SqlDbType.NVarChar, 60).Value = password;
 command.Parameters.Add("@Remark", SqlDbType.NVarChar, 60).Value = remark;
 command.Parameters.Add("@Mail", SqlDbType.NVarChar, 60).Value = mail;
 command.Parameters.Add("@DepartId", SqlDbType.Int, 4).Value = departId;
 command.Parameters.Add("@Power", SqlDbType.Int, 4).Value = power;
 connection.Open();
 int rowsAffected = command.ExecuteNonQuery();
 connection.Close();
 command.Dispose();
 return rowsAffected > 0;
}