The problem you have looks to be that while you are building the full SQL Command, you are only passing the command text to the DAL, not the actual command object
Normally what I do is to keep the DAL a little more separated from it's users, and pass in the query, parameter name, and value. If there are multiple values I will pass a list of key-value pairs (string, object).
public DataSet ReturnDataSet(string SQLSelectCommand, string ParamName="", object ParamValue)
{
SqlCommand cmd = new SqlCommand(SQLSelectCommand, this.sQLConnection);
if (ParamName != "")
{
cmd.Parameters.AddWithValue(ParamName, ParamValue);
}
SqlDataAdapter daGeneric = new SqlDataAdapter(cmd);
}