title: Parameterized dynamic sql query
body: <p>I have a list of keywords that i store in a list.</p>
  
  <p>To fetch records from a table, am using the following query:</p>
  
  <pre><code>sqlBuilder.Append("SELECT name, memberid FROM members WHERE");
  StringBuilder sqlBuilder = new StringBuilder();
  foreach (string item in keywords)
              {
              sqlBuilder.AppendFormat(" LOWER(Name) LIKE '%{0}%' AND", item); 
              }
  string sql = sqlBuilder.ToString();
  </code></pre>
  
  <p>As you might have noticed, my query is vulnerable to sql injection, thus i want to use parameters using SqlCommand(). I have tried the following but still doesn't work:</p>
  
  <pre><code>foreach (string item in keywords)
              {    
                  sqlBuilder.AppendFormat(" LOWER(Name) LIKE '%' + @searchitem + '%' AND", item);
                  SqlCommand cmd = new SqlCommand(sqlBuilder.ToString());
                  cmd.Parameters.AddWithValue("@searchitem",item);
               }
  </code></pre>
  
  <p>Where could i be making the mistake, or rather, how should i got about it?</p>