使用StringBuilder与SqlParameter

好处：

防止sql注入；占用内存更少

例子：

传参有业务查询条件startDate,endDate,A,每页数据个数pageSize,当前查询页码pageIndex

            string sql = @"select A,B,C
                        FROM sc with(nolock) 
                        WHERE IsDelete!=1 {0}
                        ORDER BY A DESC
						OFFSET @pageSize*(@pageIndex-1) ROWS FETCH NEXT @pageSize ROWS ONLY";
            StringBuilder sb = new StringBuilder();
            List
   
   
    
     parameters = new List
    
    
     
     ();
            DateTime now = DateTime.Now;
            parameters.Add(new SqlParameter("@startDate", startDate==null?new DateTime(now.Year,now.Month,now.Day):startDate));
            parameters.Add(new SqlParameter("@endDate", endDate == null ? new DateTime(now.Year, now.Month, now.Day).AddDays(1) : DateTime.Parse(endDate.ToStrin