MySqlParameter

// 执行带参数的SQL增删改语句    
        /// SQL增删改语句
        /// 参数集合
        /// 返回更新的记录数
        public int ExecuteNonQuery(string sql, params MySqlParameter[] args)
        {            
            int res;
            using (comm = new MySqlCommand(sql, GetConn()))
            {                
                comm.Parameters.AddRange(parms);
                res = comm.ExecuteNonQuery();
            }
            
            return res;
        }

MySqlParameter[] args = new MySqlParameter[] {
　　　　　  new MySqlParameter("@height", Request.Form["height"]),
          new MySqlParameter("@weight", Request.Form["weight"])
         };
var sql = "update status set height=@height,weight=@weight where code =2";

db.ExecuteNonQuery(sql,args);