C#_防止SQL注入的参数化格式Where条件

public class WhereBuilder
{
    private readonly StringBuilder _whereBuilder = new StringBuilder();
    private readonly List<SugarParameter> _parameter = new List<SugarParameter>();
 
    public void Append(string s) => Append(s, null, null);
 
    public void Append(string s, string parameterName, object parameter)
    {
        if (_whereBuilder.Length > 0)
        {
            _whereBuilder.Append(" and " + s);
        }
        else
        {
            _whereBuilder.Append(" where " + s);
        }
 
        if (!string.IsNullOrEmpty(parameterName))
        {
            _parameter.Add(new SugarParameter(parameterName, parameter));
        }
    }
 
    public override string ToString() => _whereBuilder.ToString();
 
    public void Build(out string whereSql, out SugarParameter[] parameters)
    {
        whereSql = ToString();
 
        if (_parameter.Any())
        {
            parameters = _parameter.ToArray();
        }
        else
        {
            parameters = null;
        }
    }
}