title: MySQL parameterized query is functioning like it is not parameterized in C# application
body: <p>I keep getting this error: MySql.Data.MySqlClient.MySqlException: 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''Feature: SecurityTesting @mytag Scenario: SQL Injection Given I visit ' at line 1'</p>
  <p>The parameter Gherkin is the one causing the query to fail. I have tried both ? and @ as parameter prefixes and nothing changes.</p>
  <p>Here's my code:</p>
  <pre><code>string CommandText = &quot; INSERT INTO Feature(`Path`, Gherkin, RepoID, `Name`, Updated) VALUES (?Path,  ?Gherkin , ?RepoID, ?Name, ?Updated) ON DUPLICATE KEY UPDATE Gherkin = VALUES(?Gherkin); &quot;;
  
  
         
  
              using (MySqlConnection connection = new MySqlConnection())
              {
                  connection.ConnectionString = ConfigurationManager.ConnectionStrings[&quot;TAF_DB&quot;].ConnectionString;
                  using (MySqlCommand command = new MySqlCommand())
                  {
  
                      var gherkinParam = new MySqlParameter(&quot;Gherkin&quot;, test.Gherkin);
                      //var gherkinParam = new MySqlParameter(&quot;Gherkin&quot;, MySqlDbType.VarChar);
                      var pathParam = new MySqlParameter(&quot;Path&quot;, MySqlDbType.VarChar);
                      var RepoIDParam = new MySqlParameter(&quot;RepoID&quot;, MySqlDbType.Int64);
                      var nameParam = new MySqlParameter(&quot;Name&quot;, MySqlDbType.VarChar);
                      var updatedParam = new MySqlParameter(&quot;Updated&quot;, MySqlDbType.VarChar);
  
                      gherkinParam.Value = test.Gherkin;
                      command.Parameters.Add(gherkinParam);
                      pathParam.Value = test.Path;
                      command.Parameters.Add(pathParam);
                      RepoIDParam.Value = test.RepoID;
  
                      command.Parameters.Add(RepoIDParam);
                      nameParam.Value = test.Name;
  
                      command.Parameters.Add(nameParam);
                      updatedParam.Value = test.Updated;
                      command.Parameters.Add(updatedParam);
  
                      command.Connection = connection;
                      command.CommandType = CommandType.Text;
                      command.CommandText = CommandText;
                      connection.Open();
                      command.ExecuteNonQuery();
                      connection.Close();
  
                  }
              }
  </code></pre>