sql参数化查询SqlParameter

刚开始拼sql查询串的时候我是按照一般思路进行的

string sql = "select * from tabelName where Title like '%@condition%' or Icontent like '%@condition%' order by tdate desc";

 

但是查询不出东西，最后查阅资料发现 得这样拼

string sql = "select * from tabelName where Title like '%'+@condition+'%' or Icontent like '%'+@condition+'%' order by tdate desc";	

之后的代码是

SqlParameter[] values = new SqlParameter[] { new SqlParameter("@condition", condition) };
                DataTable table = DBHelper.GetDataSet(sql, values); 
                foreach (DataRow row in table.Rows)
                {//进行赋值}