SQL Exception not handled in user code - sql-server

Question

The following error is occurring when i run my code below. I am running a user registration page with details such as first name, last name, user name, password ect. "ID" is my primary key. Error: "An exception of type 'System.ArgumentException' occurred in System.Data.dll but was not handled in user code
Additional information: Format of the initialization string does not conform to specification starting at index 0."
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Configuration;
using System.Data.SqlClient;
using System.Data;
namespace WebApplication_Assignment
{
public partial class User_Registration_WebForm : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
}
protected void Button_SubmitUserReg_Click(object sender, EventArgs e)
{
//Response.Write("Your registration is successful");
string sql = "SELECT * from User_Table where User_Name = #username";
using (SqlConnection connection = new SqlConnection("ConnectionString"))
using (SqlCommand command = new SqlCommand(sql, connection))
{
var userParam = new SqlParameter("username", SqlDbType.VarChar);
userParam.Value = TextBox_UserName.Text;
command.Parameters.Add(userParam);
var results = command.ExecuteReader();
}

Answer 1

Because you are not using parameters, you have a surname (lastname) that is almost certainly "O'Sullivan" See that single quote; it is causing the TSQL statement to be improperly formed.
If you concatenate strings you run into problems like this and open yourself up to SQL Injection attacks. Always use parameters.
Here's a simple example:
string sql = "SELECT * from employee where username = #username";
using (SqlConnection connection = new SqlConnection("connection string")
using (SqlCommand command = new SqlCommand(sql, connection))
{
var userParam = new SqlParameter("username", SqlDbType.VarChar);
userParam.Value = txtUsername.Text;
command.Parameters.Add(userParam);
var results = command.ExecuteReader();
}
There are numerous references to SQL Injections attacks on SO. Here's one example:
Why do we always prefer using parameters in SQL statements?