参数化操作数据库，不用拼接字符串

　 SqlParameter[] para = new SqlParameter[]
{
new SqlParameter("@user_name",SqlDbType.NVarChar,10),
new SqlParameter("@user_sex",SqlDbType.NVarChar,10),
new SqlParameter("@user_age",SqlDbType.NVarChar,10),
new SqlParameter("@region",SqlDbType.NVarChar,10)
};
para[0].Value = "李立";
para[1].Value = "男";
para[2].Value = "25";
para[3].Value = "常德";
mysql.exeprocedure("test_insert", para);
　public int exeprocedure(string procename,SqlParameter[] para)
{
int count;
SqlConnection myconn = new SqlConnection(settings);
myconn.Open();
SqlCommand mycmd = new SqlCommand(procename,myconn);
mycmd.CommandType = CommandType.StoredProcedure;
mycmd.CommandText = procename;
if (para != null)
{

mycmd.Parameters.AddRange(para);
}
count = mycmd.ExecuteNonQuery();
myconn.Close();
return  count;
}