SQL 参数化模糊查询

          List<SqlParameter> listSqlParameter = new List<SqlParameter>(); 
           string   _strWhere += " AND ( Name LIKE @Name OR Mobile LIKE @Mobile )";
                listSqlParameter.Add(new SqlParameter("@Name", "%" + keywords + "%"));
                listSqlParameter.Add(new SqlParameter("@Mobile", "%" + keywords + "%"));


     /// <summary>
        /// 判断查询条件 自动拼接 
        /// </summary> 
        /// <param name="str"></param>
        /// <returns></returns>
        /// <remarks>
        /// 判断语句中包含 WHERE  AND OR 才会拼接 否则不处理
        /// </remarks>
        public static string Where_Splice(string str)
        {
            int length = 7;
            if (str.Length < length)
            {
                length = str.Length;
            }
            string subStr = str.Substring(0, length).ToUpper();

            if (subStr.Contains("WHERE"))
            {
                return str;
            }
            else
            {
                if (subStr.Contains("AND")|| subStr.Contains("OR"))
                {
                    str = " WHERE 1=1 " + str;
                    return str;
                }
            }
            return str;
        }