List<SqlParameter> paras = new List<SqlParameter>();

                if (!string.IsNullOrEmpty(ciName))

                {

                    sql += " and ci_name like @ciName ";

                    paras.Add(new SqlParameter("@ciName", "%"+ciName+"%"));

                }

SqlParameter[] param = paras.ToArray();

string sql = "SELECT StudentID,StudentNO,StudentName FROM Student WHERE StudentName like %@StudentName%";

paras.Add(new SqlParameter("@StudentName", "%"+StudentName+"%"));