C # Parameterized query database, preventing injection of __ database

Simple landing program to demonstrate the parameterized query, involving database operation should not put the user input directly with the SQL statement splicing, user input information is always unsafe,

Namespace Democonsoleapplication 02 {
Class Program
04 {
05//Database connection string, based on actual modification
The private const string ConnectionString = @ "Data source=| Datadirectory|\database1.sdf ";
07
The static void Main (string [] args)
09 {
10//Get the user input content
One Console. WriteLine ("Please enter user name");
A string Passport = Console. ReadLine ();
The Console. WriteLine ("Please enter the password");
String Password = Console. ReadLine ();
15
using (SqlConnection Conn = new SqlConnection (ConnectionString))
17 {
Conn.  Open (); Open Database
The using (SqlCommand CMD = Conn. CreateCommand ())
20 {
Cmd. CommandText = "Select * from Tb_users where passport= @UN and password= @PWD";
Cmd. Parameters. ADD (New SqlParameter ("UN", Passport);
To CMD. Parameters. ADD (New SqlParameter ("PWD", Password));
24
if (1 = = Cmd. ExecuteNonQuery ())
Console. WriteLine ("Landing success". ");
/Else
Console. WriteLine ("Landing failed.") ");
29}
30}
31
Console. Readkey (); Prevents the console program from flashing and not seeing the output
33}
34}
35}