The command object you are using requires named parameters (such as '@param') rather than '?' for parameterized queries. ...