I suspect this might be the issue.
From here:
Using Parameters with OLE DB Connection Managers
When the Execute SQL task uses the OLE DB connection manager, the BypassPrepare property of the task is available. You should set this property to true if the Execute SQL task uses SQL statements with parameters.
What do you have the property set to, assuming this is an ole db connection. If it is not ole db, what is it?