Параметризированный запрос sql

private DataTable GetData()
{
   //строка соединения
   string connString = @"Data Source=DEVELOPER;Initial Catalog=Northwind;Integrated Security=SSPI; Connection Timeout=260";
 
   SqlConnection con = new SqlConnection(connString);
 
   DataTable dt = new DataTable();
   try
   {
      string query = @"SELECT     Customers.CompanyName, Customers.ContactName, Orders.ShipVia, Orders.Freight, Orders.ShipName, Orders.ShipAddress, Orders.ShipCity, Orders.ShipRegion, Orders.ShipPostalCode, Orders.ShipCountry
FROM         Customers INNER JOIN
                      Orders ON Customers.CustomerID = Orders.CustomerID";
      SqlCommand comm = new SqlCommand(query, con);
 
      con.Open();
      SqlDataAdapter da = new SqlDataAdapter(comm);
      DataSet ds = new DataSet();
      da.Fill(ds);
      dt = ds.Tables[0];
   }
   catch(Exception ex)
   {
      MessageBox.Show(ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
   }
   finally
   {
      con.Close();
      con.Dispose();
   }
   return dt;
}

string query = @"SELECT     Customers.CompanyName, Customers.ContactName, Orders.ShipVia, Orders.Freight, Orders.ShipName, Orders.ShipAddress, Orders.ShipCity, Orders.ShipRegion, Orders.ShipPostalCode, Orders.ShipCountry
FROM         Customers INNER JOIN
                      Orders ON Customers.CustomerID = Orders.CustomerID
                       WHERE  Customers.CompanyName=@company";
SqlCommand comm = new SqlCommand(query, con);
comm.Parametres.AddWithValue("@company",textBox1.Text);