防sql注入

public void show(string name,string number)
        {
            SqlConnection conn = new SqlConnection(connection);

            string sql =@"select * from TblSp where name=@name || number=@number";

SqlParameter[] parameter = new SqlParameter[]
             {
                  new SqlParameter(){ParameterName="@name",SqlDbType=SqlDbType.NVarChar,Value=name},
                   new SqlParameter(){ParameterName="@@number",SqlDbType=SqlDbType.NVarChar,Value=number}
             };