在ASP.Net中防止SQL注入

I have this code

我有这段代码

UPDATE OPENQUERY (db,'SELECT * FROM table WHERE ref = ''"+ Ref +"'' AND bookno = ''"+ Session("number") +"'' ') 
UPDATE OPENQUERY (d