SQL Injection is made possible by concatenating a value taken from user-input into your sql query string. Like say if you have a textbox denoting a user's name, without using parameters you would do something like this: string sql = "Select * from Users where Name = '" + tbName.text + "'";
Well, say if I was an attacker I could fill in a sql injection attack there in that textbox and it would work. However, when using parameters, your sql string is composed of something like this: "Select * from Users where Name = @Name"
Then in the dynamic query engine, the parameter is passed to the sql server in the same way a parameter is passed to a stored procedure. So instead of reading the sql string verbatim and processing it, it processes the string, then plugs in the appropriate parameter values, preventing processing of any malicious code.
