string atUsername = "@username"; //does not work
        //string atUsername = "Demo1"; //THIS WORKS
        string atPassword = "@password"; //does not work
        //string atPassword = "222"; //THIS WORKS
        string sql = @"SELECT userId, userName, password, status, roleId, vendorId
        FROM users
        WHERE username = '" + atUsername + "' AND password = '" + atPassword + "'";

        SqlCommand cmd = new SqlCommand(sql);

        cmd.Parameters.Add(atUsername, SqlDbType.NVarChar, 20);
        cmd.Parameters[atUsername].Value = "Demo1";
        //cmd.Parameters.AddWithValue //also does not work


        cmd.Parameters.Add(atPassword, SqlDbType.NVarChar, 20);
        cmd.Parameters[atPassword].Value = "222";
        //cmd.Parameters.AddWithValue //also does not work

        SqlConnection conn = new SqlConnection(connStr);
        cmd.Connection = conn;
        conn.Open();

        SqlDataAdapter sda = new SqlDataAdapter(cmd);
        DataTable dt = new DataTable();
        sda.Fill(dt);

        Console.WriteLine(dt.Rows != null);
        if (dt.Rows != null)
        {
            Console.WriteLine(dt.Rows.Count);
        }

        conn.Close();
        conn.Dispose();