ExecuteQuery 参数化查询中字符串不需要加单引号

ExecuteQuery 参数化查询中字符串不需要加单引号

class Program
{
    static void Main(string[] args)
    {
        using (var dbContext = new DataClasses1DataContext())
        {
            string user = "%user%";

            // 错误：字符串拼接，有注入风险，且需要手动加单引号
            var list = dbContext.ExecuteQuery<UserEx>(
                "select * from [user] where Name like '%" + user + "%' and ID = 2").ToList();

            // 正确：参数化查询，字符串不需要加单引号，也不需要 '{0}'
            var list2 = dbContext.ExecuteQuery<UserEx>(
                "select * from [user] where Name like {0} and ID = {1}", user, 2).ToList();
        }
    }
}Code language: JavaScript (javascript)