C#防止注入式攻击的方法

public bool Exists(int ID)
{
StringBuilder strSql=new StringBuilder();
strSql.Append("select count(1) from T_AfterSaleCustomer");
strSql.Append(" where ID=@ID ");
SqlParameter[] parameters = {
new SqlParameter("@ID", SqlDbType.Int,4)};
parameters[0].Value = ID;


return DbHelperSQL.Exists(strSql.ToString(),parameters);
}