ADO.netでASP.netでSQLインジェクション対策をクリスマスに

Imports Oracle.DataAccess.Client
Imports System.Data

Partial Class _Default
    Inherits System.Web.UI.Page

    Protected Sub Button1_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles Button1.Click
        Dim Con As New OracleConnection
        Dim Cmd As New OracleCommand
        Dim Dr As OracleDataReader
        Dim P1 As New OracleParameter("empno", OracleDbType.Int32)
        Con.ConnectionString = "user id=ユーザーＩＤ;password=パスワード;data source=TNS;"
        Con.Open()
        '単純なものなら変数宣言してCintが通るかどうかでやってもいいかもね。
        'dim empnoparameter as integer 
        'empnoparameter = cint(trim(me.textbox1.text))みたく
        P1.Value = Trim(Me.TextBox1.Text)
        Cmd.Parameters.Add(P1)
        Cmd.CommandText = "select * from emp where empno = :empno"
        Cmd.Connection = Con
        Dr = Cmd.ExecuteReader()
        Me.GridView1.DataSource = Dr
        Me.GridView1.DataBind()
        'Me.DataGridView1.Refresh()

    End Sub
End Class