title: C# Parameterized MySQL query
body: <p>How do I change below code to Visual Studio analyze note below? I want to change below my code to parameterized MySQL query?</p>
  <blockquote>
  <p>CA2100    Review SQL queries for security vulnerabilities The query string passed to 'MySqlDataAdapter.MySqlDataAdapter(string, MySqlConnection)' in 'LogIn.button1_Click(object, EventArgs)' could contain the following variables 'this.userIDText.Text', 'this.password.Text'. If any of these variables could come from user input, consider using a stored procedure or a parameterized SQL query instead of building the query with string concatenations.</p>
  </blockquote>
  <pre><code>MySqlConnection cs = new MySqlConnection(@&quot;Persist Security Info=True;Password=XXX;User ID=XXX;Initial Catalog=hypolk_safranbp_tgl;Data Source=XXX;Character Set=utf8&quot;);
  
  cs.Open();
  DataSet ds = new DataSet();
  MySqlDataAdapter da = new MySqlDataAdapter(@&quot;Select UserName,Password from Staff where UserName='&quot; + userIDText.Text + &quot;' AND Password='&quot; + password.Text + &quot;'&quot;, cs);
  da.Fill(ds);
  
  int count = ds.Tables[0].Rows.Count;
  </code></pre>