SqlParameter

It is the way to implement query parameterization. For example if you have a query like this:

SELECT * FROM Person WHERE Name=@name

Name column would be matched against a parameter value provided from the outside.

Using parameters saves you from many bad things in database programming. Benefits from parameterized queries are:
1. Database engine compiles the statement only once, rather than on every execution - This is because parameterized query is always the same, only parameter values vary.
2. Parameters are strongly typed - For example, if you are storing dates to database, you don't have to bother with date format when writing the fixed query.
3. Parameters save you from SQL injection attacks.

SQL injection is a dangerous thing and it works like this. If you wrote the query above in code as:
string query = "SELECT * FROM Person WHERE Name='" + name + "'";

and variable name is picked from the text box, filled by the user, then user might write this in the text box:
'; DROP DATABASE Users; SELECT * FROM Person WHERE Name='hacker

In that case, your query would become:
SELECT * FROM Person WHERE Name=''; DROP DATABASE Users; SELECT * FROM Person WHERE Name='hacker'

And this query, when executed, would drop your database... It is syntaxically correct and it would execute.

Zoran