C#中的变量如何传给SQL

 新手问题C#中的变量如何传给SQL,比如SqlCommand myCommand = new SqlCommand("select zkzh,school,name,n1,fzf from yw01 where substring(zkzh,5,3)='001'"我想将'001'换成一个变量fkd,应该用什么方法,是不是在变量前加什么字符?

 

1.string fzf = "001";SqlCommand myCommand = new SqlCommand("select zkzh,school,name,n1,fzf from yw01 where substring(zkzh,5,3)=@fzf";cmd.Parameters.Add("@fzf",fzf);

 

2.

如:String str="select zkzh,school,name,n1,fzf from yw01 where aaa='"+aaa+"'";//字符串型变量 String str="select zkzh,school,name,n1,fzf from yw01 where aaa="+aaa;//int型变量

如果使用存储过程也可以构建参数传递,如:
SqlParameter[] paras = { new SqlParameter("@RolesName", SqlDbType.VarChar, 50), new SqlParameter("@RolesDescription", SqlDbType.VarChar, 100), new SqlParameter("@CreateDate", SqlDbType.DateTime, 8) };
  paras[0].Value = roles.RolesName;
  paras[1].Value = roles.RolesDescription;
  paras[2].Value = roles.CreateDate;