SQL parameterisering

using (var conn = new SqlConnection("my database connection string"))
    {
        var cmd = conn.CreateCommand();
        cmd.CommandText = "select * from Data where name=@name";
        cmd.Parameters.Add("name", SqlDbType.NVarChar, 200);
        var reader = await cmd.ExecuteReaderAsync();
        if (reader.HasRows)
            await reader.ReadAsync();
        return reader["SomeColumn"];
    }