It’s a bound parameter marker. You’ll need to list all bound parameters in the Parameters collection.
Using bound parameters as opposed to just constructing the SQL text directly helps with security (prevents injection attacks) and performance.
solved What does @ mean when creating a SQL query with C#? [duplicate]