SQL Server Parameters

[jamesclarke112]

I have no problem with the coding of sql parameters, but could someone give me an explanation or a good link of why I should use them.

Consider if I had a variable called

dim strName as String =  "John"

I could then do either

sqlCmd.CommandText = "SELECT * FROM contacts WHERE name = '" & strName & "'"

or

sqlCmd.CommandText = "SELECT * FROM contacts WHERE name = @name"
sqlCmd.Parameters.Add(New SqlCeParameter("@name", strName))

Thankyou