title: Error: Variable names must be unique within a query batch or stored procedure. Incorrect syntax near the keyword 'WHERE'
body: <p>Can anyone help me with this error. IT says, </p>
  
  <blockquote>
    <p>The variable name '@UserID' has already been declared. Variable names
    must be unique within a query batch or stored procedure. Incorrect
    syntax near the keyword 'WHERE'.</p>
  </blockquote>
  
  <p>The error appears on the <code>cmd.ExecuteNonquery();</code></p>
  
  <p>Here is my code:</p>
  
  <pre><code>protected void btnUpdateAccount_Click(object sender, EventArgs e)
      {
          con.Open();
          SqlCommand cmd = new SqlCommand();
          cmd.Connection = con;
          if (txtPassword.Text == "")
          {
              cmd.CommandText = "UPDATE Users SET EmailAddress=@EmailAddress, FirstName=@FirstName, " +
                  "LastName=@LastName, Address=@Address, ContactNo=@ContactNo, Image=@Image, " +
                  "WHERE UserID=@UserID";
          }
          else
          {
              cmd.CommandText = "UPDATE Users SET Password=@Password, EmailAddress=@EmailAddress, FirstName=@FirstName, " +
                  "LastName=@LastName, Address=@Address, ContactNo=@ContactNo, Image=@Image, " +
                  "WHERE UserID=@UserID";
          }
          cmd.Parameters.Add("@EmailAddress", SqlDbType.NVarChar).Value = txtEmail.Text;
          cmd.Parameters.Add("@Password", SqlDbType.NVarChar).Value = Helper.CreateSHAHash(txtPassword.Text);
          cmd.Parameters.Add("@FirstName", SqlDbType.VarChar).Value = txtFN.Text;
          cmd.Parameters.Add("@LastName", SqlDbType.VarChar).Value = txtLN.Text;
          cmd.Parameters.Add("@Address", SqlDbType.NVarChar).Value = txtAddress.Text;
          cmd.Parameters.Add("@ContactNo", SqlDbType.NVarChar).Value = txtContact.Text;
          cmd.Parameters.Add("@UserID", SqlDbType.Int).Value = Session["userid"].ToString();
          if (fuImage.HasFile)
          {
              cmd.Parameters.Add("@Image", SqlDbType.Text).Value = "images/" + fuImage.FileName;
              fuImage.SaveAs(Server.MapPath("~/images/" + fuImage.FileName));
          }
          else
          {
              cmd.Parameters.Add("@Image", SqlDbType.Text).Value = imgAvatar.ImageUrl;
          }
          cmd.Parameters.Add("@UserID", SqlDbType.Int).Value = Session["UserID"].ToString();
  
          if (txtPassword.Text != "")
          {
              cmd.Parameters.Add("@Password", SqlDbType.NVarChar).Value=
                  Helper.CreateSHAHash(txtPassword.Text);
          }
  
          cmd.ExecuteNonQuery();
          con.Close();
          GetProfileInfo();
  
          pnlUpdated.Visible = true;
          Helper.AddLog(Session["userid"].ToString(), "Update", "Updated Profile Information");
          GetProfileInfo();
      }
  </code></pre>
  
  <p>Feel free to post comments for further details.</p>