sql injection....คือถ้าเราจะป้องกันการโจมตีแบบ sql injection นี่ควรใช้วิธีไหนดีครับ

Dim sqlStr = "SELECT * FROM [user] WHERE [name]='" &  nameStr & "'" _
   & " AND [Password] ='"  & PassStr & "' " 

Dim sqlStr = "SELECT * FROM [user] WHERE ([name]=@Name) AND ([Password] = @Password) "
Dim myCommand As SqlCommand = New SqlCommand( sqlStr ,myConn )

myCommand.Parameter.AddWithValue("@Name" ,UserNameStr) 
myCommand.Parameter.AddWithValue("@Password" ,PasswordStr)