c# - Must declare the scalar variable "@Email"

Question

I am trying to pass values from a database table to a couple of labels where the email column matches the email entered.I have passed the email entered from login page to this page using a session.Like This :

    protected void btnLogin_Click(object sender, EventArgs e)
    {
    if (AuthenticateUser(txtEmail.Text, txtPassword.Text))
    {
        FormsAuthentication.RedirectFromLoginPage(txtEmail.Text, chkBoxRememberMe.Checked);

        Session["Email"] = txtEmail.Text;
        Response.Redirect("~/Account.aspx");
     }

then i am passing the session value to lblEmail on ACOUNTS page.and then i am trying to retrieve values 'Name' and 'Balance' from database tabel where Emails match the one in the table.Like This:

     protected void Page_Load(object sender, EventArgs e)
{
    lblEmail.Text = Session["Email"].ToString();
    string CS = ConfigurationManager.ConnectionStrings["ABCD"].ConnectionString;
    using (SqlConnection con = new SqlConnection(CS))
    {
        SqlCommand cmd = new SqlCommand("Select * from tblRegister where @Email = " + lblEmail.Text, con);
        con.Open();
        SqlDataReader rdr = cmd.ExecuteReader();

        rdr.Read();
        lblName.Text = rdr["Name"].ToString();
        lblBalance.Text = rdr["Balance"].ToString();


    }

But i get a error message stating 'must declare the scalar vraiable @Email' on the line below:

   SqlDataReader rdr = cmd.ExecuteReader();

What am i doing wrong?

Answer 1

Try like this instead

  SqlCommand cmd = new SqlCommand("Select * from tblRegister where Email = @Email", con);
  cmd.Parameters.AddWithValue("@Email", lblEmail.Text);
  SqlDataReader rdr = cmd.ExecuteReader();
  //...