Preventing SQL injection when setting a sqldatasource select statement in ASP.NET c#
I have a quick question with regards to preventing SQL injection in my application.

Two different features of my web application use textboxes that a user can use to search for items from a MSSQL database. This information is displayed in a GridView.

I create the queries by using this method:

    sqldatasource.SelectCommand = "SELECT x from x where this_id LIKE '%" + txtbox.Text + "%' ORDER BY x ASC";

Obviously taking user input and entering it straight into a query like this will open it up to basic SQL injection. Please could someone explain how I can parametrise this to prevent SQL injection in my application?

Thanks in advance
Preventing SQL injection when setting a sqldatasource select statement in ASP.NET c#
===

I have a quick question with regards to preventing SQL injection in my application.

Two different features of my web application use textboxes that a user can use to search for items from a MSSQL database. This information is displayed in a GridView.

I create the queries by using this method:

    sqldatasource.SelectCommand = "SELECT x from x where this_id LIKE '%" + txtbox.Text + "%' ORDER BY x ASC";

Obviously taking user input and entering it straight into a query like this will open it up to basic SQL injection. Please could someone explain how I can parametrise this to prevent SQL injection in my application?

Thanks in advance