[C#][SQL] Sql Parameter

myConn.ConnectionString = "data source=localhost;Initial Catalog=DB;User ID=user;Password=1234";
myConn.Open();

string strEq = "AAA";
string strSQL = "";
try
{
strSQL = " Update table SET ";
strSQL += " Name = @Name, ";
strSQL += " Address = @Address ";
strSQL += " WHERE ID = '" + strEq + "' ";

SqlCommand myCmd = new SqlCommand(strSQL, myConn);
myCmd.Parameters.Clear();
SqlParameter p1 = myCmd.Parameters.AddWithValue("Name", DbType.String);
p1.Value = "David";
SqlParameter p2 = myCmd.Parameters.AddWithValue("Address", DbType.String);
p2.Value = "Taipei";
myCmd.ExecuteNonQuery();
myConn.Close();

}
catch (Exception ex)
{
//exception output
}