Avoiding string concatenation when building SQL queries.?

Short answer: Example of preventing SQL injection: SqlCommand command = new SqlCommand("SELECT * FROM Customers WHERE CustomerName = @CustomerName", connection); command.Parameters.AddWithValue("@CustomerName", customerName); // Use parameterized query

Real-world example (ShopNest)

ShopNest’s reporting job still uses ADO.NET for a heavy SQL query where raw performance and stored procedures matter more than EF convenience.

Say this in the interview

1. Define — one clear sentence (the short answer above).
2. Example — relate it to a project like ShopNest or your real work.
3. Trade-off — when you would not use it.