What SqlCommand.Parameters.AddWithValue really does?
.net, escaping, sql-injection, sqlcommand, t-sql
Solution
The ADO.NET SqlClient driver will not do any replacements! That's a common misconception - it avoids the trouble of replacing anything.
What it does is pass your query with the parameters `@param1 ... @paramN` straight to SQL Server, along with a collection of parameter name/value pairs. SQL Server then executes those using the `sp_executesql` stored proc.
No replacements are ever done, there's no "stringing together the complete SQL statement" on the client side - nothing like that. If that's what the ADO.NET runtime were doing, it, too, would be very susceptible to SQL injection attacks.
Problem
What changes `SqlCommand.Parameters.AddWithValue()` does with the query? I expect that: It replaces every `'` character by `''`, If a parameter value is a string or something which must be converted to a string, it surrounds the value by `'`, so for example `select * from A where B = @hello` will give `select * from A where B = 'hello world'`. If a parameter value is something "safe" like an integer, it is inserted in a query as is, without quotes, so `select * from A where B = @one` would give `select * from A where B = 1`. Is there any other changes I'm not aware of?