1、使用參數化SQL語句進行模糊查找的正確方法：

//定義sql語句

string sql = "SELECT StudentID,StudentNO,StudentName FROM Student WHERE StudentName like @StudentName";

//給參數賦值

command.Parameters.AddWithValue("@StudentName", txtStudentName.Text+"%");

2.錯誤做法1：

//定義sql語句

string sql = "SELECT StudentID,StudentNO,StudentName FROM Student WHERE StudentName like '@StudentName%'";

//給參數賦值

command.Parameters.AddWithValue("@StudentName", txtStudentName.Text); 

3.錯誤做法2： 

//定義sql語句 

string sql = "SELECT StudentID,StudentNO,StudentName FROM Student WHERE StudentName like @StudentName%"; 

//給參數賦值 

command.Parameters.AddWithValue("@StudentName", txtStudentName.Text);