SQL字符串查询参数

本文关键字:参数 查询 字符串 SQL | 更新日期: 2023-09-27 18:13:38

我有这个代码…c#中带有参数

的查询
var sql = @"select * from Passenger t0       
            join Ticket t1 on t0.PassengerID = t1.PassengerID               
            where t1.IsArrived = @IsArrived ";
            List<SqlParameter> parameters = new List<SqlParameter>() {  
                    new SqlParameter
                    {
                        ParameterName = "DateFrom",
                        Value = (object)fromDate ?? DBNull.Value,
                        DbType = System.Data.DbType.DateTime
                    },
                    new SqlParameter
                    {
                        ParameterName = "DateTo",
                        Value = (object)toDate ?? DBNull.Value,
                        DbType = System.Data.DbType.DateTime
                    },
                    new SqlParameter
                    {
                        ParameterName = "IsArrived",
                        Value = route,
                        DbType =System.Data.DbType.Boolean
                    },
                        new SqlParameter
                    {
                        ParameterName = "Search",
                        Value = $"'%{searchString}%'",
                        DbType = System.Data.DbType.String
                    }
                };
            var sqlQuery = sql +
                (fromDate != null ? "and t1.DateFrom >= @DateFrom " : " ") +
                (toDate != null ? "and @DateTo >= t1.DateFrom" : " ") +
                (!String.IsNullOrEmpty(searchString) ? "and (t0.FirstName like @Search or t0.LastName like @Search)" : " ");

参数"@Search"被破坏-我如何修改此查询工作?我不知道如何写这个参数的值。I tried

 Value = $@"'%{searchString}%'"
 Value = @"'%"+searchString+"%'",
 Value = $"'u0027'u0025{searchString}'u0025'u0027",
 Value = "'u0027'u0025"+searchString+"'u0025'u0027",
 Value = "''%"+searchString+"%''"

SQL字符串查询参数

var sqlQuery = sql + (fromDate != null ? "and t1.DateFrom >= @DateFrom " : " ") + (toDate != null ? "and @DateTo >= t1.DateFrom" : " ") + (!String.IsNullOrEmpty(searchString) ? "and (t0.FirstName like @Search or t0.LastName like ' + @Search+ ')" : " ");