SQL Injection Protection (C#.NET)

Alright, so I have a basic search function to look through a field in my database which is decided by a query string.
<asp:SqlDataSource ID="SqlDataSource1" runat="server" ConnectionString="<%$ ConnectionStrings:DatabaseConnectionString %>"
SelectCommand="SELECT * FROM [Employee] WHERE ([Responsibilities] LIKE '%' + @Responsibilities + '%')">
<SelectParameters>
<asp:QueryStringParameter Name="Responsibilities" QueryStringField="q" Type="String" />
</SelectParameters>
</asp:SqlDataSource>  But, I'd really like to fix it using parameterized SQL queries, so that people aren't dropping my tables.  >_>

I've been lookin' around for some code on how to do this in C#.NET, and most of them seem to look like this:
 SqlConnection objConnection = new SqlConnection(_ConnectionString);
objConnection.Open();
SqlCommand objCommand = new SqlCommand(
"SELECT * FROM User WHERE Name = @Name AND Password = @Password",
objConnection);
objCommand.Parameters.Add("@Name", NameTextBox.Text);
objCommand.Parameters.Add("@Password", PasswordTextBox.Text);
SqlDataReader objReader = objCommand.ExecuteReader(); My problem is that I don't know how really know how to go from my code to this code...  I mean, would I throw the latter in my backend code and call what it returns as a string, would I entirely replace my Datasource and do soemthin' with the code?  Any help, in the form of tutorials or just straight up tellin' me here, would be greatly appreciated.

Thanks.  =D