But the query you wrote is not working because the output sql looks something like:

select count (*) from table where clientName = @clientName....

which is actually supposed to be

select count (*) from table where clientName = 'xyz'....

--And then again, in this scenario, the parameters like clientName and vendorName are not the direct user inputs but they are extracted from an XmlDocument which is automatically generated by another applic where there is never a chance for such a sql injection..

Appreciate your suggestion, but I am not able to make ur query work without those paranthesis.