A senior developer on my team tells me that writing SQL commands like this is safe "because it's parameterized", but I don't see how
Does LINQ's ExecuteCommand provide protection from SQL injection attacks?