I've seen this question asked a couple times but I couldn't find a good answer. I've been stuck for hours on this. 

Basically I have usernames saved in a database and when a new user registers I want to check if his username is available - and if it is available add him to the database. And they register through a textbox called FName. The table is called Users.

```
SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString);

SqlCommand cmd = new SqlCommand("SELECT FName FROM Users WHERE FName =  ????? usernames????? ", con);

con.Open();
SqlDataReader reader = cmd.ExecuteReader();
while (reader.Read()) 
{
     Console.WriteLine(reader["text"].ToString());
}

```

How can I fix this code?
['https://Stackoverflow.com/questions/16947535', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/2456977/']
```
"SELECT FName FROM Users WHERE FName = @paramUsername"

```

and then you insert the parameter into the cmd like so:

```
cmd.Parameters.Add("paramUsername", System.Data.SqlDbType.VarChar);
cmd.Parameters["paramUsername"].Value = "Theusernameyouarelookingfor";

```
Check this out:

```
SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString);

string validationQuery = "SELECT * FROM Users WHERE FName = @name";
SqlCommand validationCommand = new SqlCommand(validationQuery, connection);
validationCommand.Parameters.Add("@name", SqlDbType.VarChar).Value = loginUserSelected;

connection.Open();

SqlDataReader validationReader = validationCommand.ExecuteReader(CommandBehavior.CloseConnection);

if (!validationReader.Read())
{
    string insertQuery = "INSERT INTO Users (FName) VALUES (@name)";
    SqlCommand insertCommand = new SqlCommand(insertQuery, connection);
    insertCommand.Parameters.Add("@name", SqlDbType.VarChar).Value = loginUserSelected;

    connection.Open();

    insertCommand.ExecuteNonQuery();

    insertCommand.Dispose();

    connection.Close();
}
else
{
    //Uh oh, username already taken
}

validationReader.Close();

validationCommand.Dispose();

```

Things to note:

* Use **parameters**, avoid concatenating strings because it's a security vulnerability
* Always `Close` and `Dispose` your ADO objects