ExecuteReader or ExecuteScalar runs a command whose text was built with an interpolated string containing variables.
Use parameterized commands rather than passing an interpolated SQL string to Execute methods.