title: SQL- building parameterized sql queries
body: <pre><code> OracleCommand cmd2 = cn.CreateCommand();
              cmd2.CommandText = @"SELECT name,addr,zip from master_user where username = @0";
              cmd2.Parameters.AddWithValue("0", ddlBins.SelectedValue);
  
              string x = cmd2.CommandText;
  </code></pre>
  
  <p>ddlBins above is a drop down list. 
  lets say the value i selected from the drop down list is 12.
  After executing the code above the value of string x should be:</p>
  
  <blockquote>
    <p>SELECT name,addr,zip from master_user where username = 12</p>
  </blockquote>
  
  <p>, correct?..</p>
  
  <p>But for some reason I am getting </p>
  
  <blockquote>
    <p>SELECT name,addr,zip from master_user where username = @0</p>
  </blockquote>