VS 2010 - Automated Insert SQL Query Parameterized?

I wrote this little function to allow me to pass an ArrayList of Strings and then based on the table passed to pre-build a SQLCommand like so
INSERT INTO table` (`column`,`column`) VALUES (`value1`,`value2`);

The function for this is here:
Public Function _SQLInsertBuilder(ByVal values As ArrayList, ByVal Table As String) As String
Dim commandString As String
Dim columns As ArrayList = GetTables(Table)
commandString = "INSERT INTO `" & Table & "` ("
For Each column As String In columns
[Code] .....

Now I know that much like mysql_real_escape_string() VB.NET has a Parameter ability to make querys safer. How could I parameterize the values during the build of the string.