I have the following snippet of code in my WCF web service that builds a set of where conditions according to the formatting of the values of a provided dictionary.
If you read the documentation, you'll see that when you're using SQLCommand.Prepare, you need to use Parameters.Add and assign a datatype to each parameter. There is a good code sample in that link that will show you how to do it.