SqlCommand

A SqlCommand object represents a Transact-SQL statement or stored procedure to execute against a SQL Server data source. It is part of the System.Data.SqlClient namespace in the .NET Framework and is used to interact with SQL Server databases.

To use a SqlCommand, you typically need to associate it with a SqlConnection object, which establishes the connection to the database. The SqlCommand can then be initialized with either a T-SQL query string or the name of a stored procedure.

The CommandText property holds the SQL statement or the name of the stored procedure. The Connection property specifies the SqlConnection to use for execution.

SqlCommand supports parameters, which are essential for security and efficiency. Parameters are added to the Parameters collection of the SqlCommand object. This helps prevent SQL injection attacks by ensuring that input is treated as data rather than executable code.

Execution of a SqlCommand can be done in several ways. ExecuteReader() returns a SqlDataReader for retrieving rows from the query. ExecuteNonQuery() is used for SQL statements that do not return a result set, such as INSERT, UPDATE, and DELETE statements, and returns the number of rows affected. ExecuteScalar() retrieves a single value from the first column of the first row of the result set.

SqlCommand objects should be properly disposed of after use to release database connection resources. This is often managed using a using statement in C# or a similar construct in other .NET languages.