Add multiple SQL values with same parameterized query?
<p>I'm fairly new to SQL and trying to figure out the best way to add some predefined data.  I figured out from searching around here that I should used a parameterized command to avoid a sql injection attack which isn't a huge concern in this case but I would like to avoid the possibility and learn to do it right...  Anyway here is the code I have right now:</p>

<pre><code>        using (SqlTransaction trans = connection.BeginTransaction())
        {
            foreach (IEnumerable&lt;string&gt; row in table.RowData)
            {
                using (SqlCommand sql = new SqlCommand("INSERT INTO " + table.Title
                    + " (" + string.Join(", ", table.Headers)
                    + ") VALUES (" + string.Join(", ", table.Headers.Select(x =&gt; "@" + x)) + ");", connection, trans))
                {

                    for (int i = 0; i &lt; table.Headers.Count(); i++)
                    {
                        if (string.IsNullOrEmpty(row.ElementAt(i)))
                        { sql.Parameters.AddWithValue("@" + table.Headers.ElementAt(i), DBNull.Value); }
                        else
                        { sql.Parameters.AddWithValue("@" + table.Headers.ElementAt(i), row.ElementAt(i)); }
                    }
                    sql.ExecuteNonQuery();
                }
            }
            trans.Commit();
        }
</code></pre>

<p>This seems to work and all the data gets in there but it 'feels' inefficient to me.  I'm wrapping it in a transaction so there is only one commit, but it's creating the parameters every time and just setting different values for each row.</p>

<p>Is there a way to make this use the same parameters but just set different values per row?  Or is this the best way to do this and I should not worry about it?</p>

<p>Thanks in advance for any help you can give.</p>