Asp.net parameterized fuzzy query

As we all know, the SQL statement is soy sauce:

 

Normal: Select * from [user] Where username like '% admin %'

Parameterization: Select * from [user] Where username like @ username

 

In this way, records including admin keywords are found.

This is a simple statement, which cannot be found during parameterization. You can spell the strings following the like into soy sauce:

Error: New sqlparameter ("@ username", String. Format("% '{0}' % ",Username )); 

Error: New sqlparameter ("@ username", String. Format("'% {0} % '",Username ));

Correct: New sqlparameter ("@ username", String. Format ("% {0} %", username ));

 

 

Note that when comparing the red font, a pair of single quotation marks is added, and it cannot be found ...... Why? Learn it by yourself, hahahahaha