As you know parameterized queries has two benefit against regular queries .
First for preventing of some SQL injection attacks and second take advantages
of query plan caching.
One simple example is like this.
string command = "Select FirstName from UsersTable where Age = @Age";
SqlCommand cmd = new SqlCommand(command);
cmd.Parameters.AddWithValue("@Age", textBox1.Text);
But if you want to use "Like" operator in query, scenario is a bit different.
In this post I introduce two way for doing that.
1 . using "Like" operator with plus sign in query :
string command = "Select FirstName from UsersTable where FirstName Like
'%'+ @FirstName + '%' ";
SqlCommand cmd = new SqlCommand(command);
cmd.Parameters.AddWithValue("@FirstName", textBox1.Text);
2. using percentage sign when parameter assignments :
string command = "Select FirstName from UsersTable where FirstName
Like @FirstName";
SqlCommand cmd = new SqlCommand(command);
cmd.Parameters.AddWithValue("@FirstName", string.Format("%{0}%", textBox1.Text));
Have a good time!