sql´æ´¢¹ý³Ìʱ¼äÏà¼õ - .NET¼¼Êõ / ASP.NET

CREATE PROCEDURE [selectvipcompany] 
@username varchar(50), 
@companyname varchar(50), 
@endtime varchar(1) 
AS 
declare @sql varchar(1000) 
set @sql='' 
if (@username <>null and @username <>'' ) 
  set @sql=@sql+'username like '+char(39)+'%'+@username+'%'+char(39) 
if (@companyname <>null and @companyname <>'' and @sql <>'') 
  set @sql=@sql+' and companyname like '+char(39)+'%'+@companyname+'%'+char(39) 
else if (@companyname <>null and @companyname <>'' and @sql='') 
  set @sql=@sql+'companyname like'+char(39)+' %'+@companyname+'%'+char(39) 
if (@endtime='1' and @sql <>'') 
  set @sql=@sql+' and '+datediff+char(40)+'endviptime,'+getDate()+char(41)+' <0' 
else if(@endtime='1' and @sql='') 
  set @sql=@sql+datediff+char(40)+'endviptime,'+getDate()+char(41)+' <0' 
if (@endtime='0' and @sql <>'') 
  set @sql=@sql+' and '+datediff+char(40)+'endviptime,'+getDate()+char(41)+'=0' 
else if(@endtime='0' and @sql='') 
  set @sql=@sql+datediff+char(40)+'endviptime,'+getDate()+char(41)+'=0' 
if (@sql <>'') 
  set @sql='select username,companyname,createtime,endviptime,vb_id from admin_vcompanybase where isvip=1 and '+@sql