The pattern generally runs more like this:
SqlCommand cmd = new SqlCommand("SELECT * FROM table WHERE column = @val", conn);
cmd.Parameters.AddWithValue("@val", 123);
cmd.Parameters.Add(new...);
But please read these:
SqlCommand Parameters Add vs. AddWithValue
And in particular these, if you're thinking of using AddWithValue heavily:
https://blogs.msmvps.com/jcoehoorn/blog/2014/05/12/can-we-stop-using-addwithvalue-already/
http://www.dbdelta.com/addwithvalue-is-evil/
Actually, for the most part you shouldn't really be writing code like this at all any more for the simple stuff* - there are plenty of good data access libraries/methodologies (EF, nHibernate, Dapper, DataTables) that mean that slinging SQL-inside-strings into your event handlers etc is just not necessary and is primitive/unproductive. Noone spends time writing code to raw lines on screen to represent a button; they just add a Button to the page/form. There's no need to get that low level with databases either; use a data access framework
*select blah from blah where blah
is undeniably simple stuff. Everyone should be handing those kinds of queries off to an ORM library, and i'm completely appalled that use of SqlCommand/DataReader
etc is still taught/advocated for this level of query complexity