.net sqlserver 防注入

     [HttpDelete]
        public string Delete(String userNo,string userName)
        {
            using SqlConnection connection = new SqlConnection(
                 "server=192.169.138.73;" +
                 "uid=SA;" +
                 "pwd=qwer1234.;" +
                 "database=demo1_Enviroment;" +
                 "TrustServerCertificate=true;"
                 );
            connection.Open();
            SqlCommand cmd = new SqlCommand($"DELETE from Users " +
                $"WHERE userNo =@id and userName=@name"
                , connection);

            SqlParameter[] sqlParameter = new SqlParameter[] { 
                new SqlParameter("@id",userNo),
                new SqlParameter("@name",userName)
            };
            cmd.Parameters.AddRange(sqlParameter);


            cmd.ExecuteNonQuery();

            return "删除成功";
        }

    }