SqlCommand에서 Parameter 사용

            String sSql;
            SqlCommand sqlComm;
            SqlDataReader sqlReader;

            try
            {
                sSql = "SELECT PASSWORD FROM TB_USER WHERE USERID = @USERID ";
                sqlComm = new SqlCommand(sSql, DBConnection.conn);
                sqlComm.Parameters.Add(new SqlParameter("USERID", txtUserID.Text));
                sqlReader = sqlComm.ExecuteReader();
                if (sqlReader != null && sqlReader.HasRows)
                {
                    sqlReader.Read();
                    if (sqlReader.GetString(0) == txtPassword.Text)
                        this.Close();
                    else
                    {
                        txtPassword.Text = "";
                        MessageBox.Show("비밀번호가 틀립니다.");
                    }
                }
                else
                {
                    txtUserID.Text = "";
                    MessageBox.Show("존재하지 않는 아이디 입니다.");
                }
                sqlReader.Close();
            }
            catch (SqlException ex)
            {
                Program.angLog.WriteLog(String.Format("SQLException {0}", ex.Message));
            }
            catch (Exception ex)
            {
                Program.angLog.WriteLog(String.Format("Exception {0}", ex.Message));
            }