I can't find where to add parameters

Question

What kind of changes i can make to this code to protect against sql injection?

private void button1_Click(object sender, EventArgs e)
        {
               string query = "INSERT INTO person (name_,age_)VALUES('" + txtFirstname.Text + "','" + int.Parse(txtAge.Text) + "')";
               DB.OpenConnection();
               DB.SqlQuery = query;
               DB.ExecuteQuery();
               DB.CloseConnection();
        }

Answer 1

Something like below

    string query = "INSERT INTO person (name_,age_) VALUES(@name,@age)";
    MySqlCommand m = new MySqlCommand(query);
    m.Parameters.AddWithValue("@name", txtFirstname.Text);
    m.Parameters.AddWithValue("@age", int.Parse(txtAge.Text));

(OR)

m.Parameters.Add(new MySqlParameter("@name", txtFirstname.Text));