php 多条件参数化查询,多条件查询 VS 参数化查询

///

/// 产品搜索

///

/// 产品名称

/// 产品分类ID,-1时忽略

///

private DataTable List(string productName, int categoryID)

{

DataTable table = new DataTable();

try

{

using (SqlConnection conn = new SqlConnection("server=127.0.0.1;database=Northwind;user id=sa;password=sa"))

{

using (SqlCommand cmd = new SqlCommand())

{

cmd.Connection = conn;

if (categoryID == -1)

cmd.CommandText = "select * from Products where ProductName=@ProductName";

else

cmd.CommandText = "select * from Products where ProductName=@ProductName and CategoryID=@CategoryID";

cmd.CommandType = CommandType.Text;

cmd.CommandTimeout = 100;

SqlParameter[] parms = new SqlParameter[]{

new SqlParameter("@ProductName", SqlDbType.NVarChar),

new SqlParameter("@CategoryID", SqlDbType.Int)

};

parms[0].Value = productName;

parms[1].Value = categoryID;

for (int i = 0; i < parms.Length; i++)

cmd.Parameters.Add(parms[i]);

using (SqlDataAdapter adapter = new SqlDataAdapter(cmd))

{

adapter.Fill(table);

}

}

}

}

catch { }

return table;

}