string statement = "SELECT TOP " maxRecords " * FROM Customers ";
string whereConcatenator = "WHERE ";
if (companyNameTextBox.Text.Length > 0)
{
　statement = whereConcatenator;
　statement = "CompanyName like '" companyNameTextBox.Text "%' ";
　whereConcatenator = "AND ";
}

if (cityTextBox.Text.Length > 0)
{
　statement = whereConcatenator;
　statement = "City like '" cityTextBox.Text "%' ";
　whereConcatenator = "AND ";
}
if (countryComboBox.SelectedItem != null)
{
　statement = whereConcatenator;
　statement = "Country = '" countryComboBox.SelectedItem "' ";
　whereConcatenator = "AND ";
}

　　我相信上面的代碼對你來說是非常熟悉的，你可能在過去的十多年一直是這樣使用的，或者你曾經編碼過數據庫驅動的搜索功能。讓我告訴你這種思想:這種查詢你的數據庫的方法不能再使用了，它是難看的也是不安全的。

　　SelectQueryBuilder方式的代碼

　　同樣的查詢能夠使用SelectQueryBuilder類建立。

SelectQueryBuilder query = new SelectQueryBuilder();
query.SelectFromTable("Customers");
query.SelectAllColumns();
query.TopRecords = maxRecords;
if (companyNameTextBox.Text.Length > 0)
　query.AddWhere("CompanyName", Comparison.Like,companyNameTextBox.Text "%");
　if (cityTextBox.Text.Length > 0)
　　query.AddWhere("City", Comparison.Like,
　　cityTextBox.Text "%");
　if (countryComboBox.SelectedItem != null)
　　query.AddWhere("Country", Comparison.Equals,
　　countryComboBox.SelectedItem);
　　string statement = query.BuildQuery();
　　// or, have a DbCommand object built
　　// for even more safety against SQL Injection attacks:
　　query.SetDbProviderFactory(
　　DbProviderFactories.GetFactory(
　　"System.Data.SqlClient"));
　　DbCommand command = query.BuildCommand();