C#中的變數如何傳給SQL

 新手問題C#中的變數如何傳給SQL,比如SqlCommand myCommand = new SqlCommand("select zkzh,school,name,n1,fzf from yw01 where substring(zkzh,5,3)='001'"我想將'001'換成一個變數fkd,應該用什麼方法,是不是在變數前加什麼字元?

 

1.string fzf
= "001";SqlCommand myCommand
= new SqlCommand("select zkzh,school,name,n1,fzf
from yw01 where substring(zkzh,5,3)=@fzf";cmd.Parameters.Add("@fzf",fzf);

 

2.

如:String str="select zkzh,school,name,n1,fzf from yw01 where aaa='"+aaa+"'";//字串型變數 String str="select zkzh,school,name,n1,fzf from yw01 where aaa="+aaa;//int型變數

如果使用預存程序也可以構建參數傳遞,如:
SqlParameter[] paras = { new SqlParameter("@RolesName", SqlDbType.VarChar, 50), new SqlParameter("@RolesDescription", SqlDbType.VarChar, 100), new SqlParameter("@CreateDate", SqlDbType.DateTime, 8) };
  paras[0].Value = roles.RolesName;
  paras[1].Value = roles.RolesDescription;
  paras[2].Value = roles.CreateDate;