问在c#中更新Oracle表

EN

        public static bool UpdateRow(Byte[] rowId, string paramXml1, string paramXml2, string paramXml3, string paramXml4,
string tblName = "XML_DATA")
    {
        string updateUser = Environment.UserName;

        try
        {
            using (connection = new OracleConnection())
            {
                connection.ConnectionString = ConnectionString;
                connection.Open();
                var command = connection.CreateCommand();
                //TODO: how to prevent sql injection? 
                var query = $"UPDATE {tblName} SET XML_DATA1=:xml1, XML_DATA2=:xml2, XML_DATA3=:xml3, XML_DATA4=:xml4, XML_DATA5=:updateUser, UPDATE_DATE=sysdate WHERE UUID=:rowID)";
                command.CommandText = query;
                command.Parameters.Add(new OracleParameter("xml1", paramXml1.ToUpper()));
                command.Parameters.Add(new OracleParameter("xml2", paramXml2.ToUpper()));
                command.Parameters.Add(new OracleParameter("xml3", paramXml3.ToUpper()));
                command.Parameters.Add(new OracleParameter("xml4", paramXml4));
                command.Parameters.Add(new OracleParameter("updateUser", updateUser.ToUpper()));
                command.Parameters.Add(new OracleParameter("rowID", rowId));
                int rowUpdated = command.ExecuteNonQuery();
                if (rowUpdated > 0)
                {
                    return true;
                }
            }
        }
        catch (OracleException e)
        {
        }
        return false;
    }