sql模糊匹配中%、_的處理

防sql注入之模糊匹配中%、_處理：

 　　　　　　　StringBuilder sbSql = new StringBuilder();
             sbSql.Append(@"SELECT * from tablename t where 1 = 1 ");     
             string name = dictparameters["Name"].ToString();    //Name參數值
                if(name.Contains("%") || name.Contains("_"))
                {
                    name = name.Replace("%", "/%").Replace("_", "/_");
                    sbSql.AppendFormat(@" AND t.Name like '%{0}%' ESCAPE '/'", name);
                }
                else
                {
                    sbSql.AppendFormat(@" AND t.Name like '%{0}%'", name);
                }

 上述采用的是拼接字符串，現改為參數化，防止sql注入：

　　　　　　　StringBuilder sbSql = new StringBuilder();
            sbSql.Append(@"SELECT * from tablename t where 1 = 1 ");
            string name = dictparameters["Name"].ToString();    //Name參數值
            if (name.Contains("%") || name.Contains("_"))
            {
                name = name.Replace("%", "/%").Replace("_", "/_");
                sbSql.Append(@" AND t.Name like '%' + @Name+ '%' + ESCAPE '/'");
            }
            else
            {
                sbSql.Append(@" AND t.Name like '%' + @Name+ '%'");
            }