我知道在查询中使用参数可以防止SQL注入(当从用户输入中获取值时)。但是如果我想要构造一个使用预定义的值的查询，例如

MySqlCommand Command = Connection.CreateCommand();
Command.CommandText = "SELECT employee_address FROM employees WHERE employee_name = @employee_name";
Command.Parameters.AddWithValue("employee_name", "John");

我可以不用这个代替吗？

MySqlCommand Command = Connection.CreateCommand();
Command.CommandText = "SELECT employee_address FROM employees WHERE employee_name = 'John'";

在此场景中是否需要使用参数？
我也可以这样做吗？

string employee_name = "John"; //value depends on some sort of selection (not user input)

MySqlCommand Command = Connection.CreateCommand();
Command.CommandText = "SELECT employee_address FROM employees WHERE employee_name = '" + employee_name + "'";