TR Forums

Fair enough. I still used parameterized queries even when I'm in a tightly controlled environment, however, as I've never had to program something where resources were so limited that the overhead of of using parameters caused a significant performance reduction, and it's now such a habit that I would actually have to consciously force myself to use string-mashed query.

Actually, parameterized queries can provide a performance improvement in many cases, if you're using a DB engine that is smart enough to precompile and optimize them. Of course, one as generic as the code earlier doesn't offer much opportunity for optimization. I'd use them anyway: today's "tightly controlled environment" is tomorrow's infrastructure, buried and forgotten several levels down, with the new top layer open to teh intrawebs.

SQL Server should do something similar to Oracle that precompiles and caches queries. So the performance aspect is there with a properly utilized parameterized query. It's not a big deal for your intranet app, but learning best practices is always a Good Thing (TM).

I was thinking more performance overhead on the client (web server) side of things, than the database server.