c# and sql injection

Does anyone know of a good example where you can prevent sql injection attacks in a basic c# input form?

- i have done the xxxx.replace("'","''")

- i have paramterize my variables

- i have created a stored procedure

 - what else can be done, i read where you can create an array of bad charracters then loop through that array with your textbox.text value

but am having a hard time finding an example of that.

 
...