C#参数化SQL查询

//写一个存储过程

ALTER PROCEDURE dbo.Infosearch

    

    (

    @bmid smallint = null,

    @xm varchar(10)=null,

    @xb varchar(10)=null,

    @strage smallint=null,

    @endage smallint=null,

    @zzmm varchar(10)=null,

    @xl varchar(10)=null,

    @zw varchar(10)=null

    )

    

AS

    /* SET NOCOUNT ON */ 

    declare @sql varchar(100)

    if @bmid is not null

    begin 

        set @sql=' where 部门ID='+Convert(varchar(10),@bmid)

    end

    

    if @xm is not null

    begin

        if @sql is not null

            set @sql=@sql+' and 姓名like'+@xm

        else set @sql=' where 姓名like'+@xm

    end

    

    if @xb is not null

    begin 

        if    @sql is not null

            set @sql=@sql+' and 性别='+@xb

        else set @sql=' where 性别='+@xb

    end

    

    if @strage is not null

    begin

        if @sql is not null

            set @sql=@sql+' and 年龄between '+Convert(varchar(10),@strage)

        else set @sql=' where 年龄between '+Convert(varchar(10),@strage)

    end

    

    if @endage is not null

    begin 

        set @sql=@sql+' and '+Convert(varchar(10),@endage)

    end

    

    if @zzmm is not null

    begin

        if @sql is not null

             set @sql=@sql+' and 政治面貌='+@zzmm

        else set @sql=' where 政治面貌='+@zzmm

    end

    

    if @xl is not null

    begin

        if @sql is not null

            set @sql=@sql+' and 学历='+@xl

        else set @sql=' where 学历='+@xl

    end

    

    if @zw is not null

    begin

        if @sql is not null

            set @sql=@sql+' and 职位='+@zw

        else set @sql=' where 职位='+@zw

    end

    

    exec('select 职工号,姓名,性别,年龄,学历,婚姻状况,政治面貌from yuangong'+@sql)

    RETURN

 



ALTER PROCEDURE dbo.Infosearch

    

    (

    @bmid smallint = null,

    @xm varchar(10)=null,

    @xb varchar(10)=null,

    @strage smallint=null,

    @endage smallint=null,

    @zzmm varchar(10)=null,

    @xl varchar(10)=null,

    @zw varchar(10)=null

    )

    

AS

    /* SET NOCOUNT ON */ 

    declare @sql varchar(100)

    if @bmid is not null

    begin 

        set @sql=' where 部门ID='+Convert(varchar(10),@bmid)

    end

    

    if @xm is not null

    begin

        if @sql is not null

            set @sql=@sql+' and 姓名like'+@xm

        else set @sql=' where 姓名like'+@xm

    end

    

    if @xb is not null

    begin 

        if    @sql is not null

            set @sql=@sql+' and 性别='+@xb

        else set @sql=' where 性别='+@xb

    end

    

    if @strage is not null

    begin

        if @sql is not null

            set @sql=@sql+' and 年龄between '+Convert(varchar(10),@strage)

        else set @sql=' where 年龄between '+Convert(varchar(10),@strage)

    end

    

    if @endage is not null

    begin 

        set @sql=@sql+' and '+Convert(varchar(10),@endage)

    end

    

    if @zzmm is not null

    begin

        if @sql is not null

             set @sql=@sql+' and 政治面貌='+@zzmm

        else set @sql=' where 政治面貌='+@zzmm

    end

    

    if @xl is not null

    begin

        if @sql is not null

            set @sql=@sql+' and 学历='+@xl

        else set @sql=' where 学历='+@xl

    end

    

    if @zw is not null

    begin

        if @sql is not null

            set @sql=@sql+' and 职位='+@zw

        else set @sql=' where 职位='+@zw

    end

    

    exec('select 职工号,姓名,性别,年龄,学历,婚姻状况,政治面貌from yuangong'+@sql)

    RETURN

 //判断参数是否为空来决定怎样拼接查询语句

如果是多条件查询的话
存储过程里面就一个参数就够了

这个参数是不定条件查询语句
多条件之中判断那个是否为空 如果为空填充1=1 不为空就为条件

 public static IDataReader ExecuteReader(DbCommand comm, string sql, params object[] value)

        {

            comm.CommandText = sql;

            if (value != null && value.Length >= 0)

            {

                if (comm.CommandText.IndexOf("?") == -1)

                {

                    string[] temp = sql.Split('@');

                    for (int i = 0; i < value.Length; i++)

                    {

                        string pName;

                        if (temp[i + 1].IndexOf(" ") > -1)

                        {

                            pName = "@" + temp[i + 1].Substring(0, temp[i + 1].IndexOf(" "));

                        }

                        else

                        {

                            pName = "@" + temp[i + 1];

                        }

                        //pName = "@p" + (i + 1).ToString();

                        DbParameter p = comm.CreateParameter();

                        p.DbType = DbType.String;

                        p.ParameterName = pName;

                        p.Value = value[i];

                        comm.Parameters.Add(p);

                    }

                }

                else

                {

                    string[] temp = sql.Split('?');

                    for (int i = 0; i < value.Length; i++)

                    {

                        temp[i] = temp[i] + "@p" + (i + 1).ToString();

                        string pName = "@p" + (i + 1).ToString();

                        DbParameter p = comm.CreateParameter();

                        p.DbType = DbType.String;

                        p.ParameterName = pName;

                        p.Value = value[i];

                        comm.Parameters.Add(p);

                    }

                    StringBuilder sb = new StringBuilder();

                    for (int i = 0; i < temp.Length; i++)

                    {

                        sb.Append(temp[i]);

                    }

                    comm.CommandText = sb.ToString();

                }

            }

            if (comm.Connection.State != ConnectionState.Open)

            {

                comm.Connection.Open();

            }

            return comm.ExecuteReader(CommandBehavior.CloseConnection);

        }





调用的时候类似：ExecuteReaderParams(comm, "select * from xx where id=? and name=?",id,name);