How to protect yourself from sql injection?

Question

C++ / C#

Database.SqlQuery("exec sp_ ...", param)
this code is not protected from sql injection, how is it better to filter the parameters in this case?
Using the SqlParameters class, can you protect yourself from sql injections?

Answer 1

Using the SqlParameters class, can you protect yourself from sql injections?

It is possible and necessary. When using parameters and prepared statements, values ​​for a particular request can be passed generally separately from the syntax of the request. In any case, the driver of a particular DBMS will be responsible for the correctness, and not you.

Answer 2

ORM should filter.
Check that you are following best practice: https://www.owasp.org/index.php/SQL_Injection_Prev...
And then run it with a vulnerability scanner. For example https://metascan.ru