C#(Secure Query For[Insert/Update/Delete])

using System;

using System.Collections.Generic;

using System.Linq;

using System.Web;

using System.Data;

using System.Data.SqlClient;

/// <summary>

/// Summary description for Item

/// </summary>

public class Item

{

    #region Properties

        public int Column01 { get; set; }

        public string  Column02  { get; set; }

        public int  Column03  { get; set; }

        public byte  Column04  { get; set; }

    #endregion

    public bool SaveAndEdit(int? ID, string Name, int MenuCategoryId, byte? Image)

    {

        try

        {

            string strQuery = string.Empty;

            string strError = string.Empty;

            DALayer layer = new DALayer();

            DataSet ds;

            if (ID == null)

            {

                #region INSERT

                #region AutoID

                //Auto ID

                strQuery = "Select isnull(Max(ID),0) + 1 as ID  from Item";

                ds = new DataSet();

                ds = layer.FetchRecords(strQuery, ref strError);

                int strID = int.Parse(ds.Tables[0].Rows[0]["ID"].ToString());

                // End Auto ID

                #endregion

                strQuery = "INSERT INTO  <Table_Name> (Id, [Name], MenuCategoryId, [Image]) " +

                                    "Values(@ID, @Name, @MenuCategoryId, @Image)";

                SqlCommand cmd = new SqlCommand();

                cmd.Parameters.AddWithValue("@ID", strID);

                cmd.Parameters.AddWithValue("@Name", Name);

                cmd.Parameters.AddWithValue("@MenuCategoryId", MenuCategoryId);

                cmd.Parameters.AddWithValue("@Image", Image);

                layer.ExecuteQuery(cmd, ref strError);

                if (strError == "T")

                {

                    return true;

                }

                else

                {

                    throw new Exception(strError);

                }

                #endregion

            }

            else

            {

                #region UPDATE

                strQuery = "UPDATE <Table_Name> SET [Name] = @Name, MenuCategoryId = @MenuCategoryId, [Image] = @Image WHERE ID = @ID";

                SqlCommand cmd = new SqlCommand();

                cmd.Parameters.AddWithValue("@Name", Name);

                cmd.Parameters.AddWithValue("@MenuCategoryId", MenuCategoryId);

                cmd.Parameters.AddWithValue("@Image", Image);

                //WHERE

                cmd.Parameters.AddWithValue("@ID", ID);

                layer.ExecuteQuery(cmd, ref strError);

                if (strError == "T")

                {

                    return true;

                }

                else

                {

                    throw new Exception(strError);

                }

                #endregion

            }

        }

        catch (Exception ex)

        {

            return false;

        }

    }

    public List<Item> GetRecords()

    {

        #region GETDATA

        try

        {

            List<Item> items = new List<Item>();

            string strQuery = "SELECT a.* FROM Item a";

            string strError = string.Empty;

            DALayer layer = new DALayer();

            DataSet ds = new DataSet();

            SqlCommand cmd = new SqlCommand(strQuery);

            ds = layer.FetchRecords(cmd, ref strError);

            if (strError == "T")

            {

                if (ds.Tables[0].Rows.Count > 0)

                {

                    for (int i = 0; i < ds.Tables[0].Rows.Count; i++)

                    {

                        items.Add(new Item()

                        {

                            Id = int.Parse(ds.Tables[0].Rows[i]["Id"].ToString()),

                            Name = ds.Tables[0].Rows[i]["Name"].ToString(),

                            MenuCategoryId = int.Parse(ds.Tables[0].Rows[i]             ["MenuCategoryId"].ToString()),

                            Image = byte.Parse(ds.Tables[0].Rows[i]["Image"].ToString())

                        });

                    }

                }

            }

            else

            {

                throw new Exception(strError);

            }

            return items;

        }

        catch (Exception ex)

        {

            return null;

        }

        #endregion

    }

    public bool DeleteRecord(int id)

    {

        #region DELETE RECORD

        try

        {

            string strQuery = "DELETE FROM  <Table_Name>  WHERE ID = @ID";

            string strError = string.Empty;

            DALayer layer = new DALayer();

           

            SqlCommand cmd = new SqlCommand(strQuery);

            cmd.Parameters.AddWithValue("@ID", id);

            layer.ExecuteQuery(cmd, ref strError);

            if (strError == "T")

            {

                return true;

            }

            else

            {

                throw new Exception(strError);

            }

        }

        catch (Exception ex)

        {

            return false;

        }

        #endregion

    }

}