使用SQL參數重寫

Question

我該如何重寫它以便它使用參數而不是字符串值？我知道如何做一個「SqlCommand」，但我似乎無法在這裏工作。

protected void searchFill() 
    { 
     orderByString = orderByList.SelectedItem.Value; 
     fieldString = searchTextBox.Text; 
     string sqlStatement = "SELECT * FROM SecureOrders WHERE fName LIKE @fieldString OR lName LIKE @fieldString OR addr LIKE @fieldString OR addr2 LIKE @fieldString OR city LIKE @fieldString OR state LIKE @fieldString OR zip LIKE @fieldString OR zip LIKE @fieldString OR country LIKE @fieldString OR email LIKE @fieldString OR phone LIKE @fieldString OR ccType LIKE @fieldString OR ccNum LIKE @fieldString OR ccExp LIKE @fieldString OR cwaSource LIKE @fieldString OR cwaJoined LIKE @fieldString OR length LIKE @fieldString OR delivery LIKE @fieldString OR price LIKE @fieldString OR url LIKE @fieldString ORDER BY @orderByString"; 
     using (SqlConnection connection = new SqlConnection(connectionString.ToString())) 
     { 
      connection.Open(); 
      SqlDataAdapter dataAdapter = new SqlDataAdapter(sqlStatement, connection); 
      dataAdapter.SelectCommand.Parameters.AddWithValue("@fieldString", fieldString); 
      dataAdapter.SelectCommand.Parameters.AddWithValue("@orderByString", orderByString); 
      SqlCommandBuilder commandBuilder = new SqlCommandBuilder(dataAdapter); 
      DataSet dataSet = new DataSet(); 

      dataAdapter.Fill(dataSet, "SecureOrders"); 

      DataView source = new DataView(dataSet.Tables[0]); 
      DefaultGrid.DataSource = source; 
      DefaultGrid.DataBind(); 
      connection.Close(); 
     } 
    } 

這裏是我的另一種方法，我現在用的參數（只是告訴你我知道如何略有使用它們）的SqlDataAdapter

protected void updateCheck(bool checkValue, int identity) 
    { 
     string checkStatement = "UPDATE dbo.SecureOrders SET processed = @Processed WHERE IdentityColumn LIKE @identity"; 
     using (SqlConnection connection = new SqlConnection(connectionString.ToString())) 
     using (SqlCommand _check = new SqlCommand(checkStatement, connection)) 
     { 
      _check.Parameters.Add("@Processed", SqlDbType.Bit).Value = checkValue; 
      _check.Parameters.Add("@identity", SqlDbType.Int).Value = identity; 
      connection.Open(); 
      _check.ExecuteNonQuery(); 
      connection.Close(); 
     } 
    } 

Answer 1

實例有一個屬性叫做SelectCommand可以附加參數爲：

var dataAdapter = new SqlDataAdapter(someQuery, someConnection); 
dataAdapter.SelectCommand.Parameters.AddWithValue("@someParam", someVar);