参数化查询防止Sql注入

namespace WindowsFormsApp1
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            FillData(dataGridView1);
        }

        private void FillData(DataGridView dataGrid)
        {
            string connStr = ConfigurationManager.ConnectionStrings["Northwind"].ConnectionString;
            using (SqlConnection conn = new SqlConnection(connStr))
            {
                string sql = "select * from Employees where EmployeeID=\‘" + textBox1.Text + "\‘";
                using (SqlCommand sqlCommand = new SqlCommand(sql, conn))
                {
                    using (SqlDataAdapter sqlData = new SqlDataAdapter(sqlCommand))
                    {
                        DataTable dataTable = new DataTable();
                        sqlData.Fill(dataTable);
                        dataGrid.DataSource = dataTable;
                    }
                }
            }
        }
    }
}

namespace WindowsFormsApp1
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            FillData(dataGridView1);
        }

        private void FillData(DataGridView dataGrid)
        {
            string connStr = ConfigurationManager.ConnectionStrings["Northwind"].ConnectionString;
            using (SqlConnection conn = new SqlConnection(connStr))
            {
                string sql = "select * from Employees where EmployeeID=@EmployeeID";
                using (SqlCommand sqlCommand = new SqlCommand(sql, conn))
                {
                    SqlParameter[] sqlParameter = { new SqlParameter("@EmployeeID", textBox1.Text) };
                    sqlCommand.Parameters.AddRange(sqlParameter);
                    using (SqlDataAdapter sqlData = new SqlDataAdapter(sqlCommand))
                    {
                        DataTable dataTable = new DataTable();
                        sqlData.Fill(dataTable);
                        dataGrid.DataSource = dataTable;
                    }
                }
            }
        }
    }
}

using System;
using System.Data;
using System.Windows.Forms;
using System.Data.SqlClient;
using System.Configuration;

namespace WindowsFormsApp1
{
    public partial class Form1 : Form
    {
        string connStr = ConfigurationManager.ConnectionStrings["Northwind"].ConnectionString;
        public Form1()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            string sql = "select * from Employees where EmployeeID=@EmployeeID";
            SqlParameter[] sqlParameter = { new SqlParameter("@EmployeeID", textBox1.Text) };
            FillGridView(sql, dataGridView1, sqlParameter);
        }

        private void FillGridView(string sql, DataGridView dataGrid, SqlParameter[] sqlParameter = null)
        {
            using (SqlConnection conn = new SqlConnection(connStr))
            {
                using (SqlCommand sqlCommand = new SqlCommand(sql, conn))
                {
                    if (sqlParameter != null)
                    {
                        sqlCommand.Parameters.AddRange(sqlParameter);
                    }
                    using (SqlDataAdapter sqlDataAdapter = new SqlDataAdapter(sqlCommand))
                    {
                        DataTable dataTable = new DataTable();
                        sqlDataAdapter.Fill(dataTable);
                        dataGrid.DataSource = dataTable;
                    }
                }
            }
        }
    }
}