It's also what VS Code autoformats even C++ to by default.
Also I wonder if the other commenters reflexively saying "SQL injection" realize that is just the symptom; the underlying problem is that LINQ is not used. Even if the SQL injection was fixed, a literal SQL query is usually not the right tool in C#.
Not sure I like that, anyway.