is this code vulnerable to SQL Injections?

Question

page loads you have to fill some text boxes and then click add:

tbSpyReports spyReport = new tbSpyReports();
spyReport.sgCityLevel = Convert.ToInt32(tbCityLevel.Text);
spyReport.sgCityName = tbCityName_insert.Text; 
....
spyReport.insert();
Response.Redirect(Request.RawUrl);


SqlConnection con = ikaConn.getConn();
SqlCommand command = new SqlCommand("INSERT INTO spyReports(cityName, playerName, cityId,      islandId, cordX, cordY, " + "cityLevel, cityWall, cityWarehouse, Wood, Wine, Marble, Crystal, Sulfur, hasArmies) VALUES(" + "@cityName, @playerName, @cityId, @islandId, @cordX, @cordY, " + "@cityLevel, @cityWall, @cityWarehouse, @Wood, @Wine, @Marble, @Crystal, @Sulfur, @hasArmies)", con);
command.Parameters.Add(new SqlParameter("cityName", this.cityName));
command.Parameters.Add(new SqlParameter("playerName", this.playerName));
....
command.ExecuteNonQuery();
command.Dispose();

Answer 1

It shouldn't be vulnerable to traditional SQL injection of this form:

statement = "SELECT * FROM users WHERE name ='" + userName + "';"

as you're using parameterized queries.