asp.net sqlparameter about like parameters invalid problem _ practical skills

In the usual way, we'll write this.

Copy Code code as follows:

String searchname = "Sam";
String strSQL = "SELECT * Table1 where Name like '% @Name% '";
sqlparameter[] Parameters = {
New SqlParameter ("@Name", Searchname)
};

The result is that the query does not have the results, the tracking code does not find errors, and does not want to use string concatenation (to prevent attacks). The execution of SQL is tracked, and the problem is that SQL automatically adds single quotes to the parameters.
In fact, in SQL, you will like to parse the code into a "% ' Sam '" ", so you do not get the desired results.

Accordingly, we can change the code to:

Copy Code code as follows:

String searchname = "Sam";
String strSQL = "SELECT * from Table1 where Name like @Name";
Searchname = "%" +searchname+ "%"; Note that you do not need to add single quotes to the SQL statement to automatically add
sqlparameter[] Parameters = {
New SqlParameter ("@Name", Searchname)
};

In this way, you can achieve the desired query results.