Vulnerable formatted SQL string

AdventureWorksCS-SOH5.sql

string parameter =      "20";

string formatSQL =      @"SELECT TOP {0} P.FirstName +' '+P.LastName As ClientName, SOH.OrderDate " +
                        "FROM Sales.SalesOrderHeader SOH " +
                        "JOIN Sales.Customer C ON SOH.CustomerID = C.CustomerID " +
                        "JOIN Person.Person P ON P.BusinessEntityID = C.PersonID " +
                        "WHERE SalesPersonID = 289 " +
                        "GROUP BY P.FirstName +' '+P.LastName, SOH.OrderDate " +
                        "ORDER BY SOH.OrderDate DESC, P.FirstName +' '+P.LastName";
                        
string resultSQL =      string.Format(formatSQL, parameter);