How can I avoid SQL injection attacks in my ASP.NET application?

As others have said, don't concatenate user input to create dynamic sql statements; always use parameterized SQL when using dynamic SQL. However I will point out that this rule also applies when creating dynamic sql inside of a stored proc. This fact is something people often overlook. They think they are safe because they are "using stored procedures."

Understand what exactly SQL Injection is and then never write anything that is vulnerable to it.