使用StringBuilder与SqlParameter

好处：

防止sql注入；占用内存更少

例子：

传参有业务查询条件startDate,endDate,A,每页数据个数pageSize,当前查询页码pageIndex

string sql = @"select A,B,C FROM sc with(nolock) WHERE IsDelete!=1 {0} ORDER BY A DESC OFFSET @pageSize*(@pageIndex-1) ROWS FETCH NEXT @pageSize ROWS ONLY"; StringBuilder sb = new StringBuilder(); List<SqlParameter> parameters = new List<SqlParameter>(); DateTime now = DateTime.Now; parameters.Add(new SqlParameter("@startDate", startDate==null?new DateTime(now.Year,now.Month,now.Day):startDate)); parameters.Add(new SqlParameter("@endDate", endDate == null ? new DateTime(now.Year, now.Month, now.Day).AddDays(1) : DateTime.Parse(endDate.ToString()).AddDays(1))); parameters.Add(new SqlParameter("@A", A)); parameters.Add(new SqlParameter("@pageSize", pageSize)); parameters.Add(new SqlParameter("@pageIndex", pageIndex)); if (startDate != null) sb.Append(" and sc.Date>=@startDate "); if (endDate != null) sb.Append(" and sc.Date<@endDate "); if (!string.IsNullOrEmpty(A)) sb.Append(" and sc.A=@A "); sql = string.Format(sql, sb); //查询数据库

转载于:https://www.cnblogs.com/Lulus/p/7874190.html

相关资源：数据结构—成绩单生成器