This blog defines SQL Injection in Windows Forms Application.

using System;

using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Data;
using System.Data.SqlClient;
using Microsoft.Data.Schema.ScriptDom;
using Microsoft.Data.Schema.ScriptDom.Sql;
using System.IO;

namespace WindowsFormsApplication1
{
public partial class Form1 : Form
{
public Form1()
{
InitializeComponent();
}

SqlConnection con = new SqlConnection(@"connectionstring");

SqlCommand cmd = new SqlCommand();
private void Form1_Load(object sender, EventArgs e)
{
DataTable dt = new System.Data.DataTable();
cmd.Connection = con;
cmd.CommandText = "select LastName,FirstName,Title,City from dbo.Employees";
SqlDataAdapter da = new SqlDataAdapter(cmd);
da.Fill(dt);
dtgsearchitem.DataSource = dt;
}

private void btnsearch_Click(object sender, EventArgs e)

{

bool result = validatextbox();

if (result == true)
{

String str = txtsearchitem.Text.Replace("--", " ");
str = str.Replace("/*", " ");

str = str.Replace("*/", " ");
str = str.Replace("XP_", " ");
str = str.Trim().Replace("'", "''");

DataTable dt = new System.Data.DataTable();

cmd.Parameters.Clear();
cmd.CommandText = "searchwindowselect";
cmd.CommandType = CommandType.StoredProcedure;
SqlParameter param1 = new SqlParameter("@SEARCHITEM", SqlDbType.VarChar, 100);
param1.Value = str;
cmd.Parameters.Add(param1);

SqlParameter param2 = new SqlParameter("@CONDTION", SqlDbType.VarChar, 20);

param2.Value = cmbCondition.Text.Trim();
cmd.Parameters.Add(param2);
 SqlParameter param3 = new SqlParameter("@SEARCHCONDITION", SqlDbType.VarChar, 20);
param3.Value = cmbsearchcondion.Text.Trim();
cmd.Parameters.Add(param3);

SqlDataAdapter da = new SqlDataAdapter(cmd);

da.Fill(dt);
dtgsearchitem.DataSource = dt;
}
 else
{
MessageBox.Show("Invalid search item");
}
}
private String removeUnknownCharecter(String str)
{
string[] words = str.Split('-');
str.Replace("-", " ");
str.Replace("-", " ");
return str;
}

private bool validatextbox()

{

int f = 1;

String str = txtsearchitem.Text;
string[] words = str.Split(';');
foreach (string word in words)
{
string sql = word;
var p = new TSql100Parser(true);
IList<ParseError> errors;
p.ParseStatementList(new StringReader(sql), out errors);
if (errors.Count == 0)
{
f = 0;
break;
}
}
if (f == 0)
{
return false;
}
 else
{
return true;
}
}
}
}