When you are using query parameters, you do not need to quote/convert/format the values you put into the parameters.

So in:

string forwardedSearchText = "N'\"" + Request.QueryString["SearchText"] + "\"'";

which is then used

cmdSQL.Parameters.Add(new SqlParameter("@forwardedSearchText", forwardedSearchText));

there will be double quoting of the search text and likely to interact badly.

The value of the search text will be quoted twice (note the number of quotes in the error message. Just use

cmdSQL.Parameters.Add(new SqlParameter("@forwardedSearchText", Request.QueryString["SearchText"]));

The reason SQL query parameterisation is important is to let the database's own code handle the necessary quoting/conversion/formatting rather than every programmer trying to do it (or forgetting) and likely getting it wrong. All the necessary escaping and quoting will be done by the database (either client or server side: really does not matter).

A few things:

Parameters and SQL injection safe code does NOT allow a "parameter" for a column name. So, criteria can and should use a @Parameter, but for column names a different approach is required.

You can still create injection safe code, and the approach is that in these cases (the column name is to be passed), then you simply check that the column passed is legal. You only are going to have a few possible columns allowed here, right? Say 2-5.

So, your code then becomes this:

        string forwardedSearchText = Request.QueryString["SearchText"];
        //SearchText is entered by user in textbox.
        string forwardedSearchColumn = "";// This fill with checkboxes and it varies between 1 to 6 items.


        List<string> LegalColumns = new List<string> { "Notes", "Descripiton", "ProductDesc"};
        string[] sCols = forwardedSearchColumn.Split(',');  // assume no spaces in this string

        foreach (string sCol in sCols) 
        {
            if (!LegalColumns.Contains(sCol)) 
                return;     // if columns don't verify - we exit
        }

        // if we get here, then only legal columns passed

        string strsql =
                $@"SELECT TbSoore.IdSoore, TbSoore.NameSoore, TbAye.NumberAye, 
                TbAye.IdAye, TbAye.TextAye, TbAye.TextTarjome
                FROM TbAye INNER JOIN TbSoore ON 
                TbAye.IdSoore = TbSoore.IdSoore WHERE 
                Contains(({forwardedSearchColumn}), @forwardedSearchText)";

        DataTable dt = new DataTable();

        using (SqlConnection con = new SqlConnection(strcon))
        {
            using (SqlCommand cmdSQL = new SqlCommand(strsql, con))
            {
                cmdSQL.Parameters.Add("@forwardedSearchText", SqlDbType.NVarChar).Value =  forwardedSearchText;
                con.Open();
                dt.Load(cmdSQL.ExecuteReader());
            }

And note we don't use "AddWith". We use add, and strong type the parameter.

So, simply verify that columns passed are legal.

To be fair, since the UI has check boxes for this, then it going to be "more difficult" to inject non legal columns or SQL. However, by verifying the columns are legal, then that removes the injection issues if a user were to mess with the check box values by use of browser debug tools before the post-back.

In my experience, for indexed free text searching, then only a few columns are going to be free text indexed in such databases, and thus a simple list of legal columns in your code will suffice for the vast majority of such cases. Since we verify that all columns are legal, then we are free to inject such columns directly into the SQL query.

So, here is a working sample:

Markup:

        <h3>Search for Hotel</h3>
        <asp:CheckBox ID="chkDescription" runat="server"  Text="Search Description"/>
        <asp:CheckBox ID="chkComments" runat="server"  Text="Search Comments"
            style="margin-left:35px"
            />
        <br />
        <br />


        <asp:TextBox ID="txtSearch" runat="server" 
            TextMode="MultiLine" Height="114px" Width="348px"></asp:TextBox>
        <br />
        <br />
        <asp:Button ID="cndSearch" runat="server" Text="Search"
            OnClick="cndSearch_Click"
            CssClass="btn btn-dark"
            />

        <asp:GridView ID="GridView1" runat="server"
            CssClass="table"
            width="40%">
        </asp:GridView>

So, in above, we have a check box, we can select 2 columns to search.

Our code behind is thus this:

    protected void cndSearch_Click(object sender, EventArgs e)
    {
        string sFields = "";

        if (chkComments.Checked)
            sFields = "Comments";


        if (chkDescription.Checked)
        {
            if (sFields != "")
                sFields += ", ";  // each field specified is to be seperated by , then space
            sFields += "Description";
        }

        SearchHotels(sFields, txtSearch.Text);
    }

    void SearchHotels(string FieldList, string sText)
    {
        List<string> LegalFields = new List<string> { "Description", "Comments" };

        string[] MyCheckList = FieldList.Split(new String[] { ", " }, StringSplitOptions.None);

        foreach (string MyField in MyCheckList) 
        {
            if (!LegalFields.Contains(MyField))
                return;
        }

        // we get here, then list of fields passed = legal fields
        DataTable dt = new DataTable();
        string strSQL =
            $@"SELECT HotelName, Description, Comments FROM tblHotels
            WHERE CONTAINS(({FieldList}), @SearchText)
            ORDER BY HotelName";

        Debug.Print(strSQL);
        using (SqlConnection conn = new SqlConnection(Properties.Settings.Default.TEST4))
        {
            using (SqlCommand cmd = new SqlCommand(strSQL, conn))
            {
                cmd.Parameters.Add("@SearchText", SqlDbType.NVarChar).Value = sText;
                conn.Open();
                dt.Load(cmd.ExecuteReader());

            }
        }

        GridView1.DataSource = dt;
        GridView1.DataBind();   
    }

And the result is now this:

I searched for Deer or Pool.

Remember, the text typed in MUST have valid syntax. (User must type in "And" or "or" between keywords).

Hence the result is now this: