查询ORACLE出错,这段代码有什么问题?

string username = txtUserName.Text.Trim();
string password = txtPassword.Text.Trim();

if (username == "" || password == "")
{
MessageBox.Show("用户名或密码不能为空!");
return;
}

string connstr = ConfigurationManager.ConnectionStrings["ConnStr"].ConnectionString;
using (OracleConnection conn = new OracleConnection(connstr))
{
conn.Open();
using (OracleCommand com = conn.CreateCommand())
{
com.CommandText = "select * from t_test where username=@UserName";
com.Parameters.Add("UserName",username);
using (OracleDataReader reader = com.ExecuteReader()) //执行到这句时异常:ORA-00936: 缺少表达式
{
if (!reader.Read())
{
MessageBox.Show("用户名错误!");
return;
}
com.CommandText = "select * from t_test where username=@UserName and password=@Password";
com.Parameters.Clear();
com.Parameters.Add("UserName", username);
com.Parameters.Add("Password", password);
if (Convert.ToInt32(com.ExecuteScalar())==0) //执行到这句时异常:ORA-00936: 缺少表达式
{
MessageBox.Show("密码错误!");
return;
}
MessageBox.Show("登录成功!");
}
}
}

如果不用带参查询,用拼接字符串的形式可以,不知道问题出在哪?