Parameterization of ASP. NET fuzzy query

This is a knowledge point that I think is very necessary to record. I tried n times and searched n times a long time ago, but I still haven't done it yet. Today, under the guidance of a friend of mine, I finally understood the mysteries of ASP. NET fuzzy query parameterization .....

First, an SQL statement is organized.

Example: stringbuilder strsql = new stringbuilder ();
Strsql. append ("select * From tablename where name like@ Wherelname");

// At the beginning, I am strsql. append ("select * From tablename where name like '%" + @ wherelname +"% '");

Second, the construction of parameters:

Sqlparameter [] parameters = {New sqlparameter ("@ wherename", sqldbtype. varchar, 50 )};
Parameters [0]. value ="%" + Wherefullname +"%"; // This is the key
The last step is the query with parameters .........