多条件查询，拼接SQL语句

 protected void btnseach_Click(object sender, EventArgs e)
    {
        string name = this.name.Text.Trim();
        string address = this.address.Text.Trim();
        string gender = this.gender.Text.Trim();
        string sql = "select * from UserInfo ";
        string wh = "where";
        StringBuilder sb = new StringBuilder();
        if (name != "")
        {
            sb.Append(" name like '%"+name +"%' and");
        }
        if (gender != "")
        {
            sb.Append(" gender like '%" + gender + "%' and");
        }
        if (address != "")
        {
            sb.Append(" adderss like '%" + address + "%' and");
        }
        if (name != "" || address != "" || gender != "")
        {
            sql = sql + wh + sb.ToString();
            sql = sql.Substring(0, sql.Length - 3);
        }

        DataTable dt = ExecuteDataTable(sql, null);//自己写的一个方法执行此方法返回一个DataTable对象
        if (dt.Rows.Count > 0)
        {
            GridView1.DataSource = dt;
            GridView1.DataBind();
        }
        else
        {
            GridView1.DataSource = null;
            GridView1.DataBind();
        }
           
       
    }