N年前我们是这样来 拼接查询字符串的: public string Test(string a, string b, string c,string d) { string sql = "SELECT * FROM Users WHERE 1=1"; if (!string.IsNullOrEmpty(a)) { sql += " AND name='" + a + "'"; } if (!string.IsNullOrEmpty(b)) { sql += " AND age='" + b+ "'"; } if (!string.IsNullOrEmpty(c)) { sql += " AND sex='" + c + "'"; } if (!string.IsNullOrEmpty(d)) { sql += " AND address='