Properly avoid SQL injection

Question

ALL,

According to MSDN error Invalid descriptor index return if the parameter is part of the SELECT list.

I\'m trying to execute a query