Ejecutar una consulta parametrizada

using System.Data.SqlClient;
using System.Data;
 
// cadena de conexión
string connectString = "database=test_paresco;server=am01;User ID=BACK;pwd=xxxxxx";
// objeto connection
SqlConnection connection = new SqlConnection(connectString);
// obertura
connection.Open();
// objeto Command
SqlCommand command = new SqlCommand("SELECT * FROM usr_contract WHERE " + 
                                  "ctr_ref = @contract AND ctr_exg_ref = @exg", 
                                  connection);
// parámetros
command.Parameters.Add(new SqlParameter("@contract", SqlDbType.VarChar, 5));
command.Parameters["@contract"].Value = "FTE";
command.Parameters.Add(new SqlParameter("@exg", SqlDbType.VarChar, 8));
command.Parameters["@exg"].Value = "SBF";
// objeto datareader
SqlDataReader reader = command.ExecuteReader();
Object[] row = null;
while (reader.Read())
{
    if (row == null)
        row = new Object[reader.FieldCount];
    reader.GetValues(row);
    for (int i=0; i<row.GetLength(0); i++)
    {
        if (row[i] != DBNull.Value) 
            Console.Write(row[i]);
        else
            Console.Write("NULL");
        if (i<row.GetUpperBound(0))
            Console.Write("|");
    }
    Console.WriteLine();
}
// cerramos reader
reader.Close();
// cerramos base de datos
connection.Close();