C#_防止SQL注入的参数化格式Where条件

public class WhereBuilder
{
    private readonly StringBuilder _whereBuilder = new StringBuilder();
    private readonly List<SugarParameter> _parameter = new List<SugarParameter>();

    public void Append(string s) => Append(s, null, null);

    public void Append(string s, string parameterName, object parameter)
    {
        if (_whereBuilder.Length > 0)
        {
            _whereBuilder.Append(" and " + s);
        }
        else
        {
            _whereBuilder.Append(" where " + s);
        }

        if (!string.IsNullOrEmpty(parameterName))
        {
            _parameter.Add(new SugarParameter(parameterName, parameter));
        }
    }

    public override string ToString() => _whereBuilder.ToString();

    public void Build(out string whereSql, out SugarParameter[] parameters)
    {
        whereSql = ToString();

        if (_parameter.Any())
        {
            parameters = _parameter.ToArray();
        }
        else
        {
            parameters = null;
        }
    }
}