ASP.net防止SQL注入方法

SqlConnection conn=new SqlConnection(System.Configuration.ConfigurationSettings.AppSettings["conn"]);
SqlCommand comm=new SqlCommand("update tb1 set vName=@vName,iAge=@iAge where ID=@id",conn);
SqlParameter parm1=new SqlParameter("@vName",SqlDbType.NVarChar,50);

parm1.Value=((TextBox)e.Item.FindControl("name")).Text;

SqlParameter parm2=new SqlParameter("@iAge",SqlDbType.Int);

parm2.Value=((TextBox)e.Item.FindControl("age")).Text;

SqlParameter parm3=new SqlParameter("@id",SqlDbType.Int);

parm3.Value=this.DataGrid1.DataKeys[e.Item.ItemIndex];

comm.Parameters.Add(parm1);

comm.Parameters.Add(parm2);

comm.Parameters.Add(parm3);

conn.Open();

comm.ExecuteNonQuery();

conn.Close();