title: Is this Sql-injection-proof Asp.net code?
body: <p>Problem: I have a form with text values, and a function that must return a string query based on the values of the text values too.</p>
  
  <p>Solution: I created a SQLCommand query with parameters, then I put the SQLCommand.CommandText to a string and I returned it (to the business logic that is going to handle the query)</p>
  
  <p>Main Question: Is it sql-injection proof?</p>
  
  <p>Code Example:</p>
  
  <pre><code>sQuery = "select * from xy where x like '%@txtNameParameter%'";
  
  SqlCommand cmd = new SqlCommand(sQuery);
  
  cmd.Parameters.Add("@txtNameParameter", SqlDbType.VarChar);
  cmd.Parameters["@txtNameParameter"].Value = txtName.Text;
  
  string query = cmd.CommandText;
  return query;
  </code></pre>
  
  <p>Sub question if main question is ok:
  Should I put into parameters also values of a radiobutton and dropdownmenu or are they injection-proof?</p>