You are reviewing the following code, which executes a command based on the user input entered into a TextBox control:

SqlConnection conn = new SqlConnection("Persist Security Info=False;"+
"Integrated Security=SSPI;database=northwind;server=dataServer");
string commandText = string.Format("SELECT * FROM Customers WHERE LastName='{0}'",
txtBoxLastName.Text);
SqlCommand cmd = new SqlCommand(commandText, conn);

You must make recommendations to improve security.

What should you do?