在使用Dapper操作Mysql資料庫中我介紹了使用dapper進行CURD基本操作，但在示例程式碼中引數雖然也是通過@開頭，但其實不是真正意義的引數化查詢，而是拼接sql，這種方式不利於防止sql注入，所以在Dappe中可以使用DynamicParameters動態引數集合新增引數，從而實現dapper下的引數化查詢；

示例程式碼

/// <summary>
        /// 增加一條資料
        /// </summary>
        public bool Add(User model)
        {
            DynamicParameters Parameters = new DynamicParameters();
            int cnt = 0;
            string sQuery = "INSERT INTO user (Login_Name,User_Pwd,User_Name,Phone_Num,Head_Portrait,Enabled,Create_Time,Update_Time)"
                              + " VALUES(@Login_Name,@User_Pwd,@User_Name,@Phone_Num,@Head_Portrait,@Enabled,@Create_Time,@Update_Time)";
            Parameters.Add("Login_Name", model.Login_Name);
            Parameters.Add("User_Pwd", model.User_Pwd);
            Parameters.Add("User_Name", model.User_Name);
            Parameters.Add("Phone_Num", model.Phone_Num);
            Parameters.Add("Head_Portrait", model.Head_Portrait);
            Parameters.Add("Enabled", model.Enabled);
            Parameters.Add("Create_Time", model.Create_Time);
            Parameters.Add("Update_Time", model.Update_Time);
            using (var connection = new MySqlConnection(connstr))
            {

                cnt = connection.Execute(sQuery,Parameters);
            }

            if (cnt > 0)
            {
                return true;
            }
            else
            {
                return false;
            }
        }

        /// <summary>
        /// 根據ID刪除一條資料
        /// </summary>
        public bool Delete(int id)
        {
            DynamicParameters Parameters = new DynamicParameters();
            int cnt = 0;
            string sQuery = "Delete FROM user " + "WHERE 
 
[email protected]";
            Parameters.Add("Id", id);
            using (var connection = new MySqlConnection(connstr))
            {
                cnt = connection.Execute(sQuery,Parameters);
            }
            if (cnt > 0)
            {
                return true;
            }
            else
            {
                return false;
            }
        }

        /// <summary>
        /// 更新一條資料
        /// </summary>
        public bool Update(User model)
        {
            DynamicParameters Parameters = new DynamicParameters();
            string sQuery = "UPDATE user SET 
 
[email protected]_Name,[email protected]_Pwd,[email protected]_Name,[email protected]_Num,[email protected]_Portrait,[email protected],[email protected]_Time,[email protected]_Time"+" WHERE [email protected]";
            Parameters.Add("Login_Name", model.Login_Name);
            Parameters.Add("User_Pwd", model.User_Pwd);
            Parameters.Add("User_Name", model.User_Name);
            Parameters.Add("Phone_Num", model.Phone_Num);
            Parameters.Add("Head_Portrait", model.Head_Portrait);
            Parameters.Add("Enabled", model.Enabled);
            Parameters.Add("Create_Time", model.Create_Time);
            Parameters.Add("Update_Time", model.Update_Time);
            Parameters.Add("Id", model.Id);
            int cnt = 0;
            using (var connection = new MySqlConnection(connstr))
            {
                cnt = connection.Execute(sQuery,Parameters);
            }
            if (cnt > 0)
            {
                return true;
            }
            else
            {
                return false;
            }
        }

        /// <summary>
        /// 根據ID獲取實體物件
        /// </summary>
        public User GetModel(int id)
        {
            DynamicParameters Parameters = new DynamicParameters();
            string sQuery = "SELECT Id,Login_Name,User_Pwd,User_Name,Phone_Num,Head_Portrait,Enabled,Create_Time,Update_Time FROM user " + "WHERE Id = @Id";
            Parameters.Add("Id", id);
            using (var connection = new MySqlConnection(connstr))
            {
                return connection.Query<User>(sQuery,Parameters).FirstOrDefault();
            }
        }