using (SqlConnection connection = new SqlConnection(_ConnectionString))
{                                    
using (SqlCommand command = new SqlCommand("", connection))
{
string sql = "select * from t1 where f1=@f1"; //与后面添加的参数名一样
command.Parameters.Add("@f1", SqlDbType.VarChar,255).Value = "/";
command.CommandText = sql;
connection.Open();
command.ExecuteReader();
connection.Close();
}
}