SQL预编译：

string sql = "select count(1) from xxx where xxx = @id ";
SqlParameter[] paras = new SqlParameter[] { 
      new SqlParameter("@id", id)
};
sqlHelp.executeQueryScalar(sql, paras);

简单封装了一下

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Configuration;
using System.Data;
using System.Data.SqlClient;
/// <summary>
/// 数据库操作帮助类
/// yzmm
/// </summary>
public class SqlHelp
{
    private SqlConnection conn = null;
    private SqlCommand cmd = null;
    private SqlDataReader sdr = null;
	public SqlHelp()
	{
        string connstr = ConfigurationManager.ConnectionStrings["dataSource"].ConnectionString;
        conn = new SqlConnection(connstr);
	}
    /// <summary>
    /// 获取数据库连接
    /// </summary>
    /// <returns></returns>
    private SqlConnection getConnection()
    {
        if (conn.State == ConnectionState.Closed)
        {
            conn.Open();
        }
        return conn;
    }
    /// <summary>
    /// 更新数据，返回影响行数
    /// </summary>
    /// <param name="sql"></param>
    /// <returns></returns>
    public int executeNonQuery(String sql){
        try{
            SqlCommand cmd = new SqlCommand(sql, getConnection());
            return cmd.ExecuteNonQuery();
        }catch (Exception ex){
            throw ex;
        }finally{
            if (conn.State == ConnectionState.Open){
                conn.Close();
            }
        }
    }
    /// <summary>
    /// 更新数据，返回影响行数
    /// </summary>
    /// <param name="cmdText"></param>
    /// <param name="paras"></param>
    /// <returns></returns>
    public int executeNonQuery(string cmdText, SqlParameter[] paras){
        int res;
        using (cmd = new SqlCommand(cmdText, getConnection())){
            cmd.Parameters.AddRange(paras);
            res = cmd.ExecuteNonQuery();
        }
        return res;
    }
    /// <summary>
    /// 查询数据返回DataTable
    /// </summary>
    /// <param name="sql"></param>
    /// <returns></returns>
    public DataTable executeQueryReader(string sql, SqlParameter[] paras)
    {
        DataTable dt = new DataTable();
        cmd = new SqlCommand(sql, getConnection());
        if (paras != null && paras.Length > 0)
        {
            cmd.Parameters.AddRange(paras);
        }
        using (sdr = cmd.ExecuteReader(CommandBehavior.CloseConnection))
        {
            dt.Load(sdr);
        }
        return dt;
    }
    /// <summary>
    /// 查询数据库，返回单个结果object
    /// </summary>
    /// <param name="sql"></param>
    /// <param name="paras"></param>
    /// <returns></returns>
    public object executeQueryScalar(string sql, SqlParameter[] paras)
    {
        cmd = new SqlCommand(sql, getConnection());
        if (paras != null && paras.Length > 0)
        {
            cmd.Parameters.AddRange(paras);
        }
        return cmd.ExecuteScalar();
    }
}