参数化操作数据库，不用拼接字符串

　 SqlParameter[] para = new SqlParameter[]
            {
             new SqlParameter("@user_name",SqlDbType.NVarChar,10),
             new SqlParameter("@user_sex",SqlDbType.NVarChar,10),
             new SqlParameter("@user_age",SqlDbType.NVarChar,10),
             new SqlParameter("@region",SqlDbType.NVarChar,10)
            };
            para[0].Value = "李立";
            para[1].Value = "男";
            para[2].Value = "25";
            para[3].Value = "常德";
            mysql.exeprocedure("test_insert", para);
   　public int exeprocedure(string procename,SqlParameter[] para) 
            {
                int count;
                SqlConnection myconn = new SqlConnection(settings);
                myconn.Open();
                SqlCommand mycmd = new SqlCommand(procename,myconn);
                mycmd.CommandType = CommandType.StoredProcedure;
                mycmd.CommandText = procename;
                if (para != null)
                {
                   
                        mycmd.Parameters.AddRange(para);
                }
                count = mycmd.ExecuteNonQuery();
                myconn.Close();
                return  count;
            }