title: Query doesn't execute due error within c# code due to internal parameter
body: <p>I think I'm missing something obvious here. The query executes in SQL server no problem. I've googled around and I found out you can use AddWithValue on the SQL command for the parameter @UserID but the issue is I need to search the database to get it. Below is the error the application is generating :</p>
  <pre><code>02:59:10,578 fail: Microsoft.AspNetCore.Server.Kestrel[13] Connection id &quot;0HMJJMIDP0K9M&quot;, Request id &quot;0HMJJMIDP0K9M:00000002&quot;: An unhandled exception was thrown by the application. System.Data.SqlClient.SqlException (0x80131904): Incorrect syntax near '@UserID'. Incorrect syntax near '.'. Incorrect syntax near 'VJ'. ```
  </code></pre>
  <p>Here is my code</p>
  <pre><code>        {
              var connString = decryptionService.DecryptFromBase64String(options.Value.ConnectionString); 
  
              using var conn = new SqlConnection(connString);
              await conn.OpenAsync();
  
              using var command = conn.CreateCommand();
              command.CommandText = GetSql(request.ScriptName, request.RecoveryCode);
              command.CommandType = CommandType.Text;
              await command.ExecuteNonQueryAsync();
              
              return Ok(&quot;Done&quot;);
          }
  
          private string GetSql(string scriptKey, string recoveryCode)
          {
               return scriptKey switch
              {
                  &quot;AddCode&quot; =&gt; 
                      &quot;DECLARE @UserID INT &quot; +
                      &quot;SET @UserID = (SELECT TOP 1 Id &quot; +
                      &quot;FROM [dbo].[User] &quot; +
                      &quot;WHERE Email = 'test@test.com') &quot; +
                      &quot;INSERT INTO [dbo].[Recovery] (RecoveryCode, Id, Created) &quot; + 
                      $&quot;VALUES ('{recoveryCode}', @UserID, GETUTCDATE()) &quot;,
  
                  &quot;DeleteCode&quot; =&gt;
                      &quot;DECLARE @UserID INT &quot; +
                      &quot;SET @UserID = (SELECT TOP 1 Id &quot; +
                      &quot;FROM [dbo].[User] &quot; +
                      &quot;WHERE Email = 'test@test.com') &quot; +
                      &quot;DELETE FROM [dbo].[Recovery] &quot; +
                      $&quot;WHERE RecoveryCode = {recoveryCode} AND Id = @UserID &quot;,
                      _ =&gt; throw new ArgumentException($&quot;Unknown script: {scriptKey}&quot;),
              };
          }
  </code></pre>