How to Update value by dynamic field Name using sql select query

Well, since you can't parameterize identifiers in SQL, your only option would be to use dynamic SQL for such things.
However, please note that the code that creates and execute the dynamic SQL statement needs to be written in such a way it would prevent SQL injection attacks.
The rule is quite simple - what you can't parameterize must be white-listed.

So basically, you can do something like this:

CREATE PROCEDURE UpdateCandidateInfo
(
     @ColumnName sysname, 
     @Id int,
     @value sql_Variant
)

AS

IF EXISTS
(
    SELECT 1
    FROM information_schema.columns
    WHERE Table_Name = 'Table_CandidateInfo'
    AND Column_Name = @ColumnName
)

BEGIN

    DECLARE @Sql nvarchar(4000) = N'Update Table_CandidateInfo SET '+ QUOTENAME(@ColumnName) + N' = @Value WHERE Id = @Id';

    DECLARE @Params nvarchar(4000) = N'@Value sql_Variant, @Id int'

    EXEC sp_ExecuteSql @Sql, @Params, @Value, @Id
END

GO

Please note that the code was written directly here and therefor untested - there might be mistakes in it but that's the general idea.

sysname is a system data type which is used by SQL server for all identifiers. It's basically an alias to nvarchar(128), except it's non-nullable.

sql_variant is a special data type which can be used to hold different data types inside.

use QUOTENAME to enable the use of column names containing spaces, dots, or that are reserved keywords.