SQL Injection - Is This Correct

Hi, I'm building a web application in which I want to prevent SQL injection.

I'm using stored procedures, and using queries on my app like this:

in my database...
create proc createStudy
@title varchar(200),
@text text
as
insert into studies values(@title,@text)
go

and in my web app...
query="createStudy '"+titleBox.Text+"','"+textBox.Text+"'";   //title and text boxes are textboxes, createStudy is a stored procedure in my database
odmccommand cmd = new odbccommand(query,con);
con.Open();
cmd.ExecuteNonQuery();

But before this I do this code:
if (titleBox.Text.Contains("Drop") || titleBox.Text.Contains("Delete"))
    messageLabel.Text="No permissions to do that";
else
(...my code)

Is this ok to prevent SQL injection?!?