. Net ADO splicing SQL statement with parameters

The first is DAL Code in the data access layer ：

// Method of data update 
public static int shuxing_update(s_passnature model)
        {
 string sql = "update s_passnature set [email protected]_name,[email protected]_content,[email protected]_shuxing,[email protected]_shiledaddress,[email protected]_cost,[email protected]_company,[email protected]_start,[email protected],[email protected] where [email protected]_id";
            //sqlparameter Object to add 
            SqlParameter[] parameter = {
                new SqlParameter("@pass_name",SqlDbType.VarChar,200),
                new SqlParameter("@pass_content",SqlDbType.VarChar,5000),
                new SqlParameter("@pass_shuxing",SqlDbType.VarChar,5000),
                new SqlParameter("@pass_shiledaddress",SqlDbType.VarChar,5000),
                new SqlParameter("@pass_cost",SqlDbType.Decimal),
                new SqlParameter("@pass_company",SqlDbType.VarChar,100),
                new SqlParameter("@is_start",SqlDbType.Int,4),
                new SqlParameter("@remark",SqlDbType.VarChar,5000),
                new SqlParameter("@operatorType",SqlDbType.VarChar,50),
                new SqlParameter("@pass_id",SqlDbType.Int,4)
            };
            // Object Assignment 
            parameter[0].Value = model.pass_name;
            parameter[1].Value = model.pass_content;
            parameter[2].Value = model.pass_shuxing;
            parameter[3].Value = model.shiledaddress;
            parameter[4].Value = model.pass_cost;
            parameter[5].Value = model.pass_company;
            parameter[6].Value = model.is_start;
            parameter[7].Value = model.remark;
            parameter[8].Value = model.operatorType;
            parameter[9].Value = model.pass_id;
            return Common.DbHelperSQL.ExecuteSql(sql, parameter);
        }
dbhelper The method in ：
 public static int ExecuteSql(string SQLString, params SqlParameter[] cmdParms)
        {
            using (SqlConnection conn = new SqlConnection(DbHelperSQL.connectionString))
            {
                using (SqlCommand cmd = new SqlCommand())
                {
                    try
                    {
                        DbHelperSQL. PrepareCommand(cmd,connection,(SqlTransaction)null,SQLString,cmdParms);
                        int num = cmd.ExecuteNonQuery();
                    // Clean up resources must be released after each execution , Otherwise, the program may be blocked 
                        cmd.Parameters.Clear();
                        return num;
                    }
                    catch (SqlException ex)
                    {
                        throw new Exception(ex.Message);
                    }
                    finally
                    {
                        cmd.Dispose();
                        conn.Close();
                    }
                }
            }
        }

// Data validation statements with parameters need to call this method for validation 
  private static void PrepareCommand(SqlCommand cmd, SqlConnection conn, SqlTransaction trans, string cmdText, SqlParameter[] cmdParms)
        {
            if (conn.State != ConnectionState.Open)
                conn.Open();
            cmd.Connection = conn;
            cmd.CommandText = cmdText;
            if (trans != null)
                cmd.Transaction = trans;
            cmd.CommandType = CommandType.Text;//cmdType;
            if (cmdParms != null)
            {
                foreach (SqlParameter parameter in cmdParms)
                {
                    if ((parameter.Direction == ParameterDirection.InputOutput || parameter.Direction == ParameterDirection.Input) &&
                        (parameter.Value == null))
                    {
                        parameter.Value = DBNull.Value;
                    }
                    cmd.Parameters.Add(parameter);
                }
            }
        }