Sprocs Vs Sql Queries.

i have a question.
 how do i protect my website from sql injection.
right now most of my queries are in the form of:

  Public Sub updateCredits(ByVal deduct As Int16, ByVal userid As Guid)
            Dim cmd As New SqlCommand
            Dim con As New SqlConnection(ConfigurationManager.ConnectionStrings("LocalSqlServer2").ConnectionString)

            cmd.Connection = con

            cmd.CommandType = Data.CommandType.Text
            cmd.CommandText = "Update [userprofile] SET credits = credits - @c WHERE userID= @id"
            cmd.Parameters.Add("@id", SqlDbType.UniqueIdentifier).Value = userid
            cmd.Parameters.Add("@c", SqlDbType.Int).Value = deduct


            Using con
                con.Open()
                cmd.ExecuteNonQuery()
                con.Close()
            End Using

            cmd.Dispose()

        End Sub
 
is that a safe way to do it? using parameters and stuff? or should i completely switch over to stored procedures as i hear they are safer.