动态参数化查询

List<SqlParameter> list = new List<SqlParameter>();
        string sql = "select * from sys_menu where 1=1";
        string id = "";
        string path = "0,1,";
        if (!string.IsNullOrEmpty(id))
        {
            sql += " and charindex(',' + rtrim(id) + ',' , ',' + @id + ',')>0";
            list.Add(new SqlParameter("@id", id));
        }
        if (!string.IsNullOrEmpty(path))
        {
            sql += " and path like @path";
            list.Add(new SqlParameter("@path", "%"+@path+"%"));
        }
        SqlParameter[] Parameters = list.ToArray();
        DataTable dt = SqlHelper.ExecuteDataTable(sql, Parameters);