Ejecutar una consulta parametrizada

using System.Data.SqlClient;
Imports System.Data.SqlClient
 
' cadena de conexión
Dim connectString As String = "database=equities;server=JV01;User ID=samfisher;pwd=echelon"
' Objeto connection
Dim connection As SqlConnection = New SqlConnection(connectString)
' obertura
connection.Open()
' Objeto Command
Dim command As SqlCommand = New SqlCommand("SELECT * FROM usr_contract WHERE " + _
                                           "ctr_ref = @contract AND ctr_exg_ref = @exg", _
                                           connection)
' parámetros
command.Parameters.Add(New SqlParameter("@contract", SqlDbType.VarChar, 5))
command.Parameters("@contract").Value = "FTE"
command.Parameters.Add(New SqlParameter("@exg", SqlDbType.VarChar, 8))
command.Parameters("@exg").Value = "SBF"
' Objecto datareader
Dim reader As SqlDataReader = command.ExecuteReader()
Dim row As Object()
While reader.Read()
 
    If row Is Nothing Then
        row = New Object(reader.FieldCount - 1) {}
    End If
    reader.GetValues(row)
    For i As Integer = 0 To row.GetLength(0) - 1
        If Not row(i) Is DBNull.Value Then
            Console.Write(row(i))
        Else
            Console.Write("NULL")
        End If
        If i < row.GetUpperBound(0) Then
            Console.Write(" | ")
        End If
    Next
    Console.WriteLine()
End While
 
' Cierre reader
reader.Close()
' Cierre connection
connection.Close()