David Hayden [MVP C#]

Parameterized queries can help you with injection attacks, but they can also help with performance as most databases will attempt to improve their performance by caching query plans.

If you use string concatentation when forming queries as shown below, the database will have to parse the command, compile it, and then come up with an execution plan for each value of customerID.

SqlCommand command = connection.CreateCommand();
command.CommandText = "SELECT * FROM Customers WHERE CustomerID = '" + customerID + "'";

// Execute the command...

You can help the database by using parameterized queries as below.  The database will recognize this command as the same for all values of customerID, and it can avoid the parsing, compiling, etc. by reusing the cached query plan.

SqlCommand command = connection.CreateCommand();
command.CommandText = "SELECT * FROM Customers WHERE CustomerID = @CustomerID";

command.Parameters.Add(
       new SqlParameter("@CustomerID", SqlDbType.NChar, 5)).Value = customerID;

// Execute the command...