防注入查询

SqlParameter[] sps = new SqlParameter[]
            {
                new SqlParameter("@name", "%" + name + "%")
            };