title: Does using parameterized SqlCommand make my program immune to SQL injection?
body: <p>I'm aware that <a href="http://xkcd.com/327/" rel="noreferrer">SQL injection is rather dangerous</a>. Now in my C# code I compose parameterized queries with <a href="http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlcommand.aspx" rel="noreferrer"><code>SqlCommand</code> class</a>:</p>
  
  <pre><code>SqlCommand command = ...;
  command.CommandText = "SELECT * FROM Jobs WHERE JobId = @JobId;";
  command.Parameters.Add("@JobId", SqlDbType.UniqueIdentifier ).Value = actualGuid;
  command.ExecuteNonQuery();
  </code></pre>
  
  <p>Will this automatically make my code immune to SQL injection? Do I have to do something extra?</p>