Preventing SQL Injection

 I have a question about SQL Injection, In some of our code we use this:
 
Replace(inString, "'", "''")  
does this prevent all forms of SQL Injection?
Also what exactly does parameterized statements do?
myCommand.Parameters.AddWithValue("@username", user); myCommand.Parameters.AddWithValue("@password", pass);
 
...