C# 中sql like in 参数化

sqlserver

//like 参数
string strSql = "select * from Person.Address where City like '%'+ @add + '%'";
SqlParameter[] Parameters=new SqlParameter[1];
Parameters[0] = new SqlParameter("@add", "bre");

//in 参数
string strSql = "exec('select * from Person.Address where AddressID in ('+@add+')')";
SqlParameter[] Parameters = new SqlParameter[1];
Parameters[0] = new SqlParameter("@add", "343,372,11481,11533,11535,11755,11884,12092,12093,12143");

mysql

//like参数
  if (!string.IsNullOrEmpty(model.TemplateName))
  {
      strSql.Append(" and main.template_name like CONCAT('%',@TemplateName,'%') ");
  }
//in参数
 strSqlCount.Append(@"SELECT
                 count(ccf.id)
             FROM
                 customer_clock_file ccf  
                 inner join customer_template_main ctm on ccf.ctm_id=ctm.id
                 WHERE FIND_IN_SET(ctm.dept_no2,CONCAT(@DeptNo2)) ");