[Asp.net] SQL Injection

[Reinmueller, Jan]

Hi Liste!   Stimmt mein Code so, wenn ich eine SQL Injection vermeiden will?                                       string SQL = "SELECT * FROM login WHERE mail= @Mail AND pswd= @Pswd;";                                     SqlCommand cmd = new SqlCommand(SQL, conn);                                     cmd.Parameters.Add("@Mail", this.email);                                     cmd.Parameters.Add("@Pswd", this.passwort);                                     SqlDataReader reader  = cmd.ExecuteReader(CommandBehavior.Default);   Danke   Jan