<p>Taking over some code from my predecessor and I found a query that uses the Like operator:</p>
<pre><code>SELECT * FROM suppliers
WHERE supplier_name like '%'+name+%';
</code></pre>
<p>Trying to avoid SQL Injection problem and parameterize this but I am not quite sure how this would be accomplished. Any suggestions ?</p>
<p>note, I need a solution for classic ADO.NET - I don't really have the go-ahead to switch this code over to something like LINQ.</p>

Simply parameterize your query:
```
```
SELECT * FROM suppliers WHERE supplier_name like '%' + @name + '%'
```
```
Now you can pass your "name" variable into the @name parameter and the query will execute without any danger of injection attacks. Even if you pass in something like "'' OR true --" it'll still work fine.