public datatable getuserlist(string strparam1,string strparam2,string strparam3,string strparam4)
{
stringbuilder sqlcontent = new stringbuilder();
arraylist paramlist = new arraylist();
sqlcontent.append(" select ");
sqlcontent.append(" column1");
sqlcontent.append(" ,column2");
sqlcontent.append(" ,column3 ");
sqlcontent.append(" ,column4 ");
sqlcontent.append(" from ");
sqlcontent.append(" tab_temp ");
sqlcontent.append(" where 1=1");
// 判斷參數是否為空或""
if (!string.isnullorempty(strparam1))
{
sqlcontent.append(" and column1 like @param1 ");
// 添加參數
paramlist.add(new mysqlparameter("@param1", "%" + strparam1+ "%"));
}
if (!string.isnullorempty(strparam2))
{
sqlcontent.append(" and column2 like @param2 ");
paramlist.add(new mysqlparameter("@param2", "%" + strparam2 + "%"));
}
if (!string.isnullorempty(strparam3))
{
sqlcontent.append(" and column3 like @param3 ");
paramlist.add(new mysqlparameter("@param3", "%" + strparam3+ "%"));
} // 腳本學堂 www.jbxue.com
if (!string.isnullorempty(strparam4))
{
sqlcontent.append(" and column4 like @param4 ");
paramlist.add(new mysqlparameter("@param4", "%" + strparam4+ "%"));
}
try
{
// 獲取db鏈接
dbconn.getconnection();
objdt = new datatable();
// 調用dbutil中查詢方法
objdt = dbconn.executequery(sqlcontent.tostring(), paramlist);
}
catch (exception e)
{
throw e;
}
finally
{
// 關閉db鏈接
dbconn.closeconnection();
}
return objdt;
}
正確的寫法：
sqlcontent.append(" and column1 like @param1 ");
// 添加參數
paramlist.add(new mysqlparameter("@param1", "%" + strparam1+ "%"));
錯誤的寫法：
sqlcontent.append(" and column1 like ‘%@param1%‘ ");
// 添加參數
paramlist.add(new mysqlparameter("@param1", strparam1));