查询防止SQL注入的方法

mysql: select * from tbl_school where school_name like concat('%',#name#,'%')    
   
oracle: select * from tbl_school where school_name like '%'||#name#||'%'    
   
sql server:select * from tbl_school where school_name like '%'+#name#+'%'