关于参数化查询的有关问题

关于参数化查询的问题

C# code

string qry = "INSERT INTO tblUser values(@name, @pwd, @roleID, @status, @memo)";            using (SqlConnection conn = SQLHelper.GetConnection())            {                try                {                    SqlCommand cmd = new SqlCommand(qry, conn);                    cmd.Parameters.Add("@name", SqlDbType.NVarChar);                    cmd.Parameters["@name"].Value = user.LoginName;

C# code

StringBuilder sb = new StringBuilder();            SqlCommand cmd = new SqlCommand();            sb.Append("SELECT * FROM tblUser WHERE 1=1");            if (user != null)            {                              if (!String.IsNullOrEmpty(user.LoginName))                {                    string name = user.LoginName;   // [color=#FF0000]我在这里先声明了一个临时变量，暂时只会这么做，有更好的方法吗？[/color]                    sb.Append(" and tu_LoginName LIKE '%" + @name + "%'");                    cmd.Parameters.Add("@name", SqlDbType.VarChar);                    cmd.Parameters["@name"].Value = user.LoginName;                }