A SqlCommand is built by concatenating untrusted strings directly into the query text.
Use parameterized queries with SqlParameter instead of concatenating values into the SQL string.