参数化查询

            DataSet dataSet = new DataSet();
            //select="SELECT * FROM XXXX WHERE BH=@BH AND KSRQ=@KSRQ AND JSRQ=@JSRQ"

            sqlCommand = new SqlCommand(select, conn);
            sqlCommand.Parameters.Add(new SqlParameter("@BH", SqlDbType.VarChar, 10));
            sqlCommand.Parameters.Add(new SqlParameter("@KSRQ", SqlDbType.VarChar, 10));
            sqlCommand.Parameters.Add(new SqlParameter("@JSRQ", SqlDbType.VarChar, 10));
            sqlCommand.Prepare();
            sqlCommand.Parameters["@BH"].Value = TextBox1.Text.Trim();
            sqlCommand.Parameters["@KSRQ"].Value = LinkButton1.Text;
            sqlCommand.Parameters["@JSRQ"].Value = LinkButton2.Text;

           

            SqlDataAdapter sqlDataAdapter = new SqlDataAdapter(sqlCommand);
            sqlDataAdapter.Fill(dataSet);

           

            GridView1.DataSource = dataSet;
            GridView1.DataBind();