防止SQL注入的一些方法

string sql = "insert into table(name,sex,address,age) values(@name,@sex,@address,@age);";
        SqlParameter[] parame = new SqlParameter[]
        {
            new SqlParameter("@name",modal.name),
            new SqlParameter("@sgex",modal.sex),
            new SqlParameter("@address",modal.address),
            new SqlParameter("@age",modal.age)
        };