не думаю, что инъекция является правильным способом решить эту проблему

private void AddValue(string strValue)

{

      //get the maximum id for Lists first

      int MaxID = DataOperations.ReturnMaxIDInATable("Lists", connString);
      int iSqlStatus = 0;
      string query = "INSERT INTO Lists(ID, ListName, ListValue) 
         VALUES(@MaxID, @ListName, @ListValue)";

      MaxID++;

      OleDbConnection dbConn = new OleDbConnection(connString);
      OleDbCommand dbComm = new OleDbCommand();

      dbComm.Parameters.Clear();
      try
      {
                dbComm.CommandText = query;
                dbComm.CommandType = CommandType.Text;

                OleDbParameter IDParam = new OleDbParameter();
                IDParam.ParameterName = "@MaxID";
                IDParam.OleDbType = OleDbType.BigInt;
                IDParam.Value = MaxID;
                dbComm.Parameters.Add(IDParam);

                dbComm.Parameters.AddWithValue("@ListName", ListName);
                dbComm.Parameters.AddWithValue("@ListValue", strValue);
                dbComm.Connection = dbConn;
                DataAccess.HandleConnection(dbConn);

                iSqlStatus = Convert.ToInt16(dbComm.ExecuteNonQuery());

                //Now check the status
                if (iSqlStatus != 0)
                {
                    //DO your failed messaging here
                    //return false;
                }
           ,     else
                {
                    //Do your success work here
                    //dbComm.
                    //return true;
                }
      }
      catch (Exception ex)
      {
                MessageBox.Show(ex.Message, "Error inserting value in "
                                            + ListName + ","
                                            + strValue);
                //return false;
      }
      finally
      {
                DataAccess.HandleConnection(dbConn);
      }

}

Ответы на вопрос(4)

Ваш ответ на вопрос