ExecuteLocalProcedure passing a string

Former Member
Former Member $organization

A couple of parameter values I'm passing are coming froma textbox. The stored procedure I'm calling doesn't like the fact that the string is not in quotes. How do I do that?

string param = "@custno=123&@notes=add some notes here.&@comments=add a comment here."
ExecuteLocalData(SessionKey, 11, param);