SQL查询字符串参数C＃

Question

我有这样的代码...在C＃与参数

var sql = @"select * from Passenger t0  
      join Ticket t1 on t0.PassengerID = t1.PassengerID    
      where t1.IsArrived = @IsArrived "; 
      List<SqlParameter> parameters = new List<SqlParameter>() { 
        new SqlParameter 
        { 
         ParameterName = "DateFrom", 
         Value = (object)fromDate ?? DBNull.Value, 
         DbType = System.Data.DbType.DateTime 
        }, 
        new SqlParameter 
        { 
         ParameterName = "DateTo", 
         Value = (object)toDate ?? DBNull.Value, 
         DbType = System.Data.DbType.DateTime 
        }, 
        new SqlParameter 
        { 
         ParameterName = "IsArrived", 
         Value = route, 
         DbType =System.Data.DbType.Boolean 
        }, 
         new SqlParameter 
        { 
         ParameterName = "Search", 
         Value = $"'%{searchString}%'", 
         DbType = System.Data.DbType.String 
        } 
       }; 
      var sqlQuery = sql + 
       (fromDate != null ? "and t1.DateFrom >= @DateFrom " : " ") + 
       (toDate != null ? "and @DateTo >= t1.DateFrom" : " ") + 
       (!String.IsNullOrEmpty(searchString) ? "and (t0.FirstName like @Search or t0.LastName like @Search)" : " "); 

参数“@Search”坏查询 - 我怎么能修改此查询工作？ 我不知道如何编写此参数的值。 我试图

Value = $@"'%{searchString}%'" 
Value = @"'%"+searchString+"%'", 
Value = $"\u0027\u0025{searchString}\u0025\u0027", 
Value = "\u0027\u0025"+searchString+"\u0025\u0027", 
Value = "\'%"+searchString+"%\'" 

Answer 1

var sqlQuery = sql + (fromDate != null ? "and t1.DateFrom >= @DateFrom " : " ") + (toDate != null ? "and @DateTo >= t1.DateFrom" : " ") + (!String.IsNullOrEmpty(searchString) ? "and (t0.FirstName like @Search or t0.LastName like ' + @Search+ ')" : " ");

不要让@Search内的字符串。