c# mysql参数化查询_C#参数化SQL查询

public static IDataReader ExecuteReader(DbCommand comm, string sql, params object[] value)

{

comm.CommandText=sql;if (value != null && value.Length >= 0)

{if (comm.CommandText.IndexOf("?") == -1)

{string[] temp = sql.Split('@');for (int i = 0; i < value.Length; i++)

{stringpName;if (temp[i + 1].IndexOf(" ") > -1)

{

pName= "@" + temp[i + 1].Substring(0, temp[i + 1].IndexOf(" "));

}else{

pName= "@" + temp[i + 1];

}//pName = "@p" + (i + 1).ToString();

DbParameter p =comm.CreateParameter();

p.DbType=DbType.String;

p.ParameterName=pName;

p.Value=value[i];

comm.Parameters.Add(p);

}

}else{string[] temp = sql.Split('?');for (int i = 0; i < value.Length; i++)

{

temp[i]= temp[i] + "@p" + (i + 1).ToString();string pName = "@p" + (i + 1).ToString();

DbParameter p=comm.CreateParameter();

p.DbType=DbType.String;

p.ParameterName=pName;

p.Value=value[i];

comm.Parameters.Add(p);

}

StringBuilder sb= newStringBuilder();for (int i = 0; i < temp.Length; i++)

{

sb.Append(temp[i]);

}

comm.CommandText=sb.ToString();

}

}if (comm.Connection.State !=ConnectionState.Open)

{

comm.Connection.Open();

}returncomm.ExecuteReader(CommandBehavior.CloseConnection);

}

调用的时候类似：ExecuteReaderParams(comm,"select * from xx where id=? and name=?",id,name);