1、使用參數(shù)化SQL語句進(jìn)行模糊查找的正確方法：

//定義sql語句

string sql = "SELECT StudentID,StudentNO,StudentName FROM Student WHERE StudentName like @StudentName";

//給參數(shù)賦值

command.Parameters.AddWithValue("@StudentName", txtStudentName.Text+"%");

2.錯誤做法1：

//定義sql語句

string sql = "SELECT StudentID,StudentNO,StudentName FROM Student WHERE StudentName like '@StudentName%'";

//給參數(shù)賦值

command.Parameters.AddWithValue("@StudentName", txtStudentName.Text); 

3.錯誤做法2： 

//定義sql語句 

string sql = "SELECT StudentID,StudentNO,StudentName FROM Student WHERE StudentName like @StudentName%"; 

//給參數(shù)賦值 

command.Parameters.AddWithValue("@StudentName", txtStudentName.Text);