SQL Injection in asp.net

protected voidButton1_Click(object sender, EventArgs e)

 {

  using (SqlConnectioncon = new SqlConnection(ConfigurationManager.ConnectionStrings["DBCS"].ConnectionString))

 {

 SqlCommand cmd = newSqlCommand();

 cmd.CommandText = "Select *from ProductTable where ProductName like '" + TextBox1.Text + "%'";

            Response.Write(cmd.CommandText);

            cmd.Connection = con;

            con.Open();

            GridView1.DataSource = cmd.ExecuteReader();    // Second method gvdatasource

            GridView1.DataBind();

 }

---------------------------------same work Prevention--------------------

using (SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["DBCS"].ConnectionString))

        {

            SqlCommand cmd = newSqlCommand();

            cmd.CommandText = "Select *from ProductTable where ProductName like @ProductName";

            cmd.Parameters.AddWithValue("@ProductName", TextBox1.Text + "%");

            Response.Write(cmd.CommandText);

            cmd.Connection = con;

            con.Open();

            GridView1.DataSource = cmd.ExecuteReader();    // Second method Gvdatasource

            GridView1.DataBind();

        }