How can this SQL query code be broken/exploited by user input? [duplicate]
It could be exlpoited by backslashes.
password = foo\' OR 1=1 --becomes:
password = foo\'' OR 1=1 --the query:
"SELECT COUNT(*) FROM UserAccounts WHERE UserName = '{0}' AND Password = 'foo\'' OR 1=1 --'"-- Is the comment mark in this example.
The solution assumes the program only filters (duplicates) apostrophes.
Well, I can't see a way it's vulnerable. So, let's argue a different reason why it should be changed --- it's rather ineffiecent. In MSSQL (and, I think, most other high end SQL servers), queries are parsed, and execution plan is devised, and then the query and plan are stored. If an exact copy of the query is requested again, the saved execution plan is used. Parameter don't affect this, so if you use parameters, it will reuse the plans; if you embed the text, it never will.