C#使用带like的sql语句时防sql注入的方法

select * from game where gamename like '%张三%'

string keywords = "张三";StringBuilder strSql=new StringBuilder();strSql.Append("select * from game where gamename like @keywords");SqlParameter[] parameters=new SqlParameter[]{ new SqlParameter("@keywords","%"+keywords+"%"), };