如何将以下查询写成参数化查询?

I have been hearing about parametrized queries every time I ask a question about database here. It looks like I am not using parametrized queries and my code may suffer from SQL injection. So here is my code: I have been hearing about parametrized queries