Using parameters to prevent disaster

[Martin Sanneblad]

How can using parameters prevent db-disaster?

Example:
(where eMail is a string containing data which the user submitted)
string query = "UPDATE `customer` SET `email` = eMail WHERE `custNo` = 1";

I read that a malicious user could put some escape-characters to trick the database into doing all sorts of bad stuff. Is this possible with the above code? Would using parameters prevent such?

Thanks,
Martin