title: Avoiding SQL Injection in SQL query with Like Operator using parameters?
body: <p>Taking over some code from my predecessor and I found a query that uses the Like operator:</p>
  <pre><code>SELECT * FROM suppliers
  WHERE supplier_name like '%'+name+%';
  </code></pre>
  <p>Trying to avoid SQL Injection problem and parameterize this but I am not quite sure how this would be accomplished. Any suggestions ?</p>
  <p>note, I need a solution for classic ADO.NET - I don't really have the go-ahead to switch this code over to something like LINQ.</p>