So, I am trying to insert a value into an SQL query using the following code:
Dim VarLetter As Data.SqlClient.SqlParameter
        Dim MyConnection As Data.SqlClient.SqlConnection
        Dim InitialCommand As Data.SqlClient.SqlCommand = New Data.SqlClient.SqlCommand( _
        "select pkclient,ClientName,Active,City, State from client Where ClientName Like '@Letter%'")
        Dim MyReader As Data.SqlClient.SqlDataReader
        MyConnection = New Data.SqlClient.SqlConnection
        MyConnection.ConnectionString = ConfigurationManager.ConnectionStrings("RASConnect ionString").ConnectionString
        InitialCommand.Connection = MyConnection
        InitialCommand.CommandType = Data.CommandType.Text

        VarLetter = New Data.SqlClient.SqlParameter
        VarLetter.ParameterName = "@Letter"
        VarLetter.SqlDbType = Data.SqlDbType.VarChar
        VarLetter.Size = 1
        VarLetter.Direction = Data.ParameterDirection.Input
        VarLetter.Value = "A"
        InitialCommand.Parameters.Add(VarLetter)

        InitialCommand.Connection.Open()
        MyReader = InitialCommand.ExecuteReader
        gvClients.DataSource = MyReader
        gvClients.DataBind()
        InitialCommand.Dispose()
        MyConnection.Dispose()

The query still runs but no results are returned. This works fine when I hard code the last part of the query as Like 'A%'.

Even when I set the VarLetter.Value = "'A%'" it doesn't work

Anyone have any ideas on why this won't work?

Well, I didn't exactly find the way to make that work but I did figure out a workaround.

Instead of having the parameter in the SQL Command and then assigning a value I am building the SQL command and including my variable. Such as this:

"select pkclient,ClientName,Active,City, State from client Where ClientName Like '" + Letter + "%'"

I believe this opens me up for an SQL Injection attack but I can't find any other option.

First, the problem you are having is that you put the variable name in a string literal. So the SQL was actually trying to find the literal string "@Letter%". You need to omit the single quotes around the variable name. Of course, then you can't put the % wildcard in the query, therefore...

I'd recommend sticking with the SqlCommand object instead of building the SQL dynamically. You should be able to just add a "%" to the end of the value entered to allow the wildcard.

Dim InitialCommand As Data.SqlClient.SqlCommand = New Data.SqlClient.SqlCommand( _
       "select pkclient,ClientName,Active,City, State from client Where ClientName Like @Letter")

VarLetter.Value = String.Format("{0}%", "A")


-Peter