如何在SQL Server中使用Like运算符对查询进行参数化

Question

I am trying to parameterize Sql Query with like operator but it's not working. Both Search Criteria and Search text will be through Variable. Here what I am doing

declare @Query nvarchar(500), @SearchBy nvarchar(50) = 'PtName', @SearchText nvarchar(50) = 'Sh'
set @Query = 'select Id, PtName, Y, M, D, Sex, PtCode, ReceiptDate, ReferBy, RefDrCd, PtTitle, NetAmount, IncentiveAmount, PaidAmount, DueAmount, Investigation, LabCode, LabName, DiscAmount, PNo  FROM DiagMain where '+@SearchBy+' like '+@SearchText+' %'
    exec(@Query)

Please Help.

Answer 1

DECLARE @Query NVARCHAR(500), @SearchBy NVARCHAR(50) = 'PtName', @SearchText NVARCHAR(50) = 'Sh'
SET @Query = 'select Id, PtName, Y, M, D, Sex, PtCode, ReceiptDate, ReferBy, RefDrCd, PtTitle, NetAmount, IncentiveAmount, PaidAmount, DueAmount, Investigation, LabCode, LabName, DiscAmount, PNo  FROM DiagMain where '+@SearchBy+' like '''+@SearchText+'%'''

PRINT @Query
EXEC(@Query)