>do you know of any example of doing parametirized queries.

Here is a simple one. Basically you define the parameter in the SQL statement by prefixing it with "@" - You then use the Parameters.Add method to set its value.

Try
   Dim sc As New SqlCommand()
   sc.Connection = oConn <--- you SQL Connection object goes here
   sc.CommandText = "select myfield from mytable where myfield = @MyValue"
   sc.Parameters.Add("@MyValue", "somevalue" )
   x = sc.ExecuteScalar()
Finally
   oConn.Close()
End Try