asp.net - Avoiding an Sql injection attack -

i have asp.net application. in have code:

 using (data.connexion)     {         string querystring = @"select id_user , nom, prenom, mail, login, mdp, last_visite, id_group, id_user_status users login =@login , mdp=@mdp";         sqlcommand command = new sqlcommand(querystring, data.connexion);         command.parameters.addwithvalue("@login", _login);         command.parameters.addwithvalue("@mdp", _password.gethashcode().tostring());         try         {             sqldatareader reader = command.executereader();                         {                 while (reader.read())                 {                     return view("success");                 }             } while (reader.nextresult());          }         catch {  }     } 

when try sql injection attack using login '' or 1=1 -- , attack failed. if change snippet 1 :

 using (data.connexion)             {                 string querystring = @"select id_user , nom, prenom, mail, login, mdp, last_visite, id_group, id_user_status users login =" + _login + " , mdp=" + _password.gethashcode().tostring();                 sqlcommand command = new sqlcommand(querystring, data.connexion);               //  command.parameters.addwithvalue("@login", _login);                // command.parameters.addwithvalue("@mdp", _password.gethashcode().tostring());                 try                 {                     sqldatareader reader = command.executereader();                                         {                         while (reader.read())                         {                             return view("success");                         }                     } while (reader.nextresult());                  }                 catch {  }             } 

i'm redirected view success attack succed.

what difference between 2 ways of coding? best ways prevent , avoid sql injection attack?

always use command parameters avoid sql injection. sql injections handled command parameter automatically. don't need worry sql injection if use command parameters.

when don't use command parameters, parameters' values inserted in sql query without handling sql injection. when use command parameters, ado.net handles sql injection you.