Can I Make This Code Better Using SQLParamater Object?

I wrote a class to handle my sqlDataReaders:

Namespace CommonFunctions

Public Class DataAccess

Public Sub New()

End Sub

Private ConnStr As String = "connectionString"

Public Function returnDR(ByVal strSQL As String) As SqlClient.SqlDataReader

Dim dr As SqlClient.SqlDataReader

Dim myCn As New SqlClient.SqlConnection(ConnStr)

Dim myCmd As New SqlClient.SqlCommand(strSQL, myCn)

myCn.Open()

dr = myCmd.ExecuteReader(CommandBehavior.CloseConnection)

Return dr

End Function ' returnDR

End Class ' Public Class DataAccess

End Namespace ' Namespace CommonFunction

The way I invoke this is:

Imports CommonFunctions

Dim da As New DataAccess

Dim sqlDataReader As SqlDataReader

Dim strSQL As New StringBuilder

strSQL.Append("Some SQL Query")

sqlDataReader = da.returnDR(strSQL.ToString())

Do While sqlDataReader.Read()

strVar = sqlDataReader("columnName")

Loop ' Do While sqlDataReader.Read()

sqlDataReader.Close()

What I would like to do, is use the SQL Paramater Object instead of passing my method a String.  One so that I dont have to explicitly test for SQL Injection and two, cause I have never worked with the SQL Paramater Object before.  :)

J