LIKE in dynamic queries

Question

我想在動態參數化查詢中使用like關鍵字。我想保護從SQL注入我的查詢，所以我不想傳遞的價值，而是我想通過我的標準，同時執行查詢，

有沒有一種方法，我可以做到這一點？

SELECT 
    ComposeMail.ID, 
    ComposeMail.DateTime, 
    ComposeMail.Subject, 
    ComposeMail.CreatedBy, 
    ComposeMail.ReceiverStatus, 
    Users.Name, 
    ROW_NUMBER() OVER(ORDER BY '+ @p_SortExpression +') AS Indexing 
FROM 
    ComposeMail 
INNER JOIN 
    Users 
ON 
    ComposeMail.CreatedBy = Users.ID 
WHERE 
    (ToReceipientID=@p) 
    AND (
    ReceiverStatus=3 
    OR ReceiverStatus=4 
) 
    AND (
    (Subject Like ''%' + @p3 + '%'') 
    OR (Body Like ''%' + @p3 + '%'') 
    OR (Name Like ''%' + @p3 + '%'') 
) 

這是我的動態查詢字符串。我不想在這裏傳遞價值。

Answer 1

爲了防止對注入你總是希望做這樣的事情一個動態查詢（而不是做「+ @var +」在你的例子）

DECLARE @query nvarchar(2000), 
     @paramList nvarchar(2000) 

SET @query = 'SELECT * FROM dbo.Orders WHERE custLastName LIKE ''%'' + @custLastName + ''%''' 
SET @paramList = '@custLastName varchar(30)' 

EXEC SP_EXECUTESQL @query, @paramList, @custLastName 

編輯：例如更新LIKE

使用

Answer 2

WHERE  (LastName LIKE N'%' + @Family + N'%') OR 
         (RegNo LIKE N'%' + @Codemeli + N'%') 

像動態SQL查詢