Yes, for those reasons, plus performance in a loop: If you concatenate SQL strings to insert a million such rows the server has to prepare a million SQL statements, but by using a parameterized statement the server prepares the statement once and uses the cached execution plan a million times (at least in theory).