Comments by Max Vagner (Top 3 by date)

You don't have to sacrifice convenience. It's possible to use SQL select statement with parameters which will prevent possibility of injection. Here's example:
SqlCommand cmd = new SqlCommand("SELECT * FROM Customers WHERE city = @City", conn);
SqlParameter param = new SqlParameter();
param.ParameterName = "@City";
param.Value = inputCity;

Off-topic: Your code is vulnerable to SQL injection. For example, If I enter "'' where 1=1--" in your textBox1, it will corrupt every single record in your database. You should avoid building SQL string. Use stored procedure instead.