The use of anti-SQL injection for C # SQL statement stitching when like case

This afternoon colleagues asked me a more basic question, when splicing SQL statements, if encountered like the situation what to do.

My original writing is a simple concatenation of strings, and later colleagues asked me what to do if I encountered SQL injection. I think about it, it's really a problem.

Just on the Internet to find the relevant instructions, the original is so written.

As such an SQL statement:

　　

Select *  from where  like ' % Zhang San% '

In C #, say:

            stringKeywords ="Zhang San"; StringBuilder strSQL=NewStringBuilder (); Strsql.append ("SELECT * from game where gamename like @keywords"); sqlparameter[] Parameters=Newsqlparameter[] {NewSqlParameter ("@keywords","%"+keywords+"%"),             };

Although the use of this is still in% to write, but can effectively filter the SQL injection situation, or is very simple and practical.

is a small knowledge point, I hope you can help! ^_^

The use of anti-SQL injection for C # SQL statement stitching when like case