Searching a database safely using SELECT
You have used parametrized query, which is the bare minimum expectation to prevent on SQL-Injection.

I would suggest some points you can take care of as a validation in C# code

I don't see any server side validation on the text you are getting from TextBoxSearch.Text, you can check for some set of character that can be an attempt for SQL Injection.

you can have a look at the set of input for SQL Injection and make sure that those characters are not there in input string before executing sql query.

Other suggestion is that if you are looking to have multiple joins etc in sql query a better choice is to convert it to Stored procedure.