SQL Update / Insert

I'm trying to better my code by rewriting my Update and Insert functions in C#.  I'm trying to keep from being subjected to SQL injection attacks.  Can anyone recommend any changes that would better my code?

protected void Button2_Click(object sender, EventArgs e) { DateTime now = DateTime.Now; SqlConnection sqlConnection1 = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["ContactManagerString"].ConnectionString); SqlCommand cmd = new SqlCommand(); cmd.CommandText = "UPDATE tbl_people SET Name_First = '@fname', Name_Middle = '@mname', Name_Last = '@lname', Spouse_Name = '@spouse', Home_Address1 = '@address1', Home_Address2 = '@address2', Home_City = '@city', Home_State = '@state', Home_Zip = '@zip', home1 = '@home1', home2 = '@home2', home3 = '@home3', mobile1 = '@mobile1', mobile2 = '@mobile2', mobile3 = '@mobile3', timestamp = '@time' WHERE use ...