SQL Injection in Windows Forms Application

This blog defines SQL Injection in Windows Forms Application.

using System;

using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Data;
using System.Data.SqlClient;
using Microsoft.Data.Schema.ScriptDom;
using Microsoft.Data.Schema.ScriptDom.Sql;
using System.IO;

namespace WindowsFormsApplication1
{
public partial class Form1 : Form
{
public Form1()
{
InitializeComponent();
}

SqlConnection con = new SqlConnection(@"connectionstring");

SqlCommand cmd = new SqlCommand();
private void Form1_Load(object sender, EventArgs e)
{
DataTable dt = new System.Data.DataTable();
cmd.Connection = con;
cmd.CommandText = "select LastName,FirstName,Title,City from dbo.Employees";
SqlDataAdapter da = new SqlDataAdapter(cmd);
da.Fill(dt);
dtgsearchitem.DataSource = dt;
}

private void btnsearch_Click(object sender, EventArgs e)

{

bool result = validatextbox();

if (result == true)
{

String str = txtsearchitem.Text.Replace("--", " ");
str = str.Replace("/*", " ");