Query parameters substitute for a single literal value, not a column name. This is standard SQL behavior, supported the same in every brand of RDBMS.
So you supplied the name of a column and it's as if you ran this query:
SELECT AVG('columnname') ...
Which is a meaningless operation. What's the AVG()
of a string?
@Matt Rogish is correct in his answer that the only way to make column names (or table names, or other SQL syntax) dynamic is to use dynamic SQL. That is, interpolate application variables into a string, and then use the resulting string as an SQL query.
You can use query parameters only to inject a single scalar value, and that's how the parameter will be interpreted in the query.