C#参数化SQL查询

//写一个存储过程

ALTER PROCEDURE dbo.Infosearch

    (
    @bmid smallint = null,
    @xm varchar()=null,
    @xb varchar()=null,
    @strage smallint=null,
    @endage smallint=null,
    @zzmm varchar()=null,
    @xl varchar()=null,
    @zw varchar()=null
    )

AS
    /* SET NOCOUNT ON */
    declare @sql varchar()
    if @bmid is not null
    begin
        set @sql=' where 部门ID='+Convert(varchar(),@bmid)
    end

    if @xm is not null
    begin
        if @sql is not null
            set @sql=@sql+' and 姓名like'+@xm
        else set @sql=' where 姓名like'+@xm
    end

    if @xb is not null
    begin
        if    @sql is not null
            set @sql=@sql+' and 性别='+@xb
        else set @sql=' where 性别='+@xb
    end

    if @strage is not null
    begin
        if @sql is not null
            set @sql=@sql+' and 年龄between '+Convert(varchar(),@strage)
        else set @sql=' where 年龄between '+Convert(varchar(),@strage)
    end

    if @endage is not null
    begin
        set @sql=@sql+' and '+Convert(varchar(),@endage)
    end

    if @zzmm is not null
    begin
        if @sql is not null
             set @sql=@sql+' and 政治面貌='+@zzmm
        else set @sql=' where 政治面貌='+@zzmm
    end

    if @xl is not null
    begin
        if @sql is not null
            set @sql=@sql+' and 学历='+@xl
        else set @sql=' where 学历='+@xl
    end

    if @zw is not null
    begin
        if @sql is not null
            set @sql=@sql+' and 职位='+@zw
        else set @sql=' where 职位='+@zw
    end

    exec('select 职工号,姓名,性别,年龄,学历,婚姻状况,政治面貌from yuangong'+@sql)
    RETURN

ALTER PROCEDURE dbo.Infosearch

    (
    @bmid smallint = null,
    @xm varchar()=null,
    @xb varchar()=null,
    @strage smallint=null,
    @endage smallint=null,
    @zzmm varchar()=null,
    @xl varchar()=null,
    @zw varchar()=null
    )

AS
    /* SET NOCOUNT ON */
    declare @sql varchar()
    if @bmid is not null
    begin
        set @sql=' where 部门ID='+Convert(varchar(),@bmid)
    end

    if @xm is not null
    begin
        if @sql is not null
            set @sql=@sql+' and 姓名like'+@xm
        else set @sql=' where 姓名like'+@xm
    end

    if @xb is not null
    begin
        if    @sql is not null
            set @sql=@sql+' and 性别='+@xb
        else set @sql=' where 性别='+@xb
    end

    if @strage is not null
    begin
        if @sql is not null
            set @sql=@sql+' and 年龄between '+Convert(varchar(),@strage)
        else set @sql=' where 年龄between '+Convert(varchar(),@strage)
    end

    if @endage is not null
    begin
        set @sql=@sql+' and '+Convert(varchar(),@endage)
    end

    if @zzmm is not null
    begin
        if @sql is not null
             set @sql=@sql+' and 政治面貌='+@zzmm
        else set @sql=' where 政治面貌='+@zzmm
    end

    if @xl is not null
    begin
        if @sql is not null
            set @sql=@sql+' and 学历='+@xl
        else set @sql=' where 学历='+@xl
    end

    if @zw is not null
    begin
        if @sql is not null
            set @sql=@sql+' and 职位='+@zw
        else set @sql=' where 职位='+@zw
    end

    exec('select 职工号,姓名,性别,年龄,学历,婚姻状况,政治面貌from yuangong'+@sql)
    RETURN
 //判断参数是否为空来决定怎样拼接查询语句

如果是多条件查询的话
存储过程里面就一个参数就够了

这个参数是不定条件查询语句
多条件之中判断那个是否为空 如果为空填充1=1 不为空就为条件

 public static IDataReader ExecuteReader(DbCommand comm, string sql, params object[] value)
        {
            comm.CommandText = sql;
            if (value != null && value.Length >= )
            {
                if (comm.CommandText.IndexOf("?") == -)
                {
                    string[] temp = sql.Split('@');
                    for (int i = ; i < value.Length; i++)
                    {
                        string pName;
                        if (temp[i + ].IndexOf(" ") > -)
                        {
                            pName = "@" + temp[i + ].Substring(, temp[i + ].IndexOf(" "));
                        }
                        else
                        {
                            pName = "@" + temp[i + ];
                        }
                        //pName = "@p" + (i + 1).ToString();
                        DbParameter p = comm.CreateParameter();
                        p.DbType = DbType.String;
                        p.ParameterName = pName;
                        p.Value = value[i];
                        comm.Parameters.Add(p);
                    }
                }
                else
                {
                    string[] temp = sql.Split('?');
                    for (int i = ; i < value.Length; i++)
                    {
                        temp[i] = temp[i] + "@p" + (i + ).ToString();
                        string pName = "@p" + (i + ).ToString();
                        DbParameter p = comm.CreateParameter();
                        p.DbType = DbType.String;
                        p.ParameterName = pName;
                        p.Value = value[i];
                        comm.Parameters.Add(p);
                    }
                    StringBuilder sb = new StringBuilder();
                    for (int i = ; i < temp.Length; i++)
                    {
                        sb.Append(temp[i]);
                    }
                    comm.CommandText = sb.ToString();
                }
            }
            if (comm.Connection.State != ConnectionState.Open)
            {
                comm.Connection.Open();
            }
            return comm.ExecuteReader(CommandBehavior.CloseConnection);
        }

调用的时候类似：ExecuteReaderParams(comm, "select * from xx where id=? and name=?",id,name);