通用分页存储过程注入问题解决方案：不用存储过程，通用分页查询方法

 public static DataTable ExecutePage(string tableName,string pk,string sort,int pageNumber,int pageSize,string Fields,string Filter,out int recordCount,SqlParameter[] pars)
        {
            StringBuilder sqlsb = new StringBuilder();
            StringBuilder wheresb = new StringBuilder();
            
            if (!string.IsNullOrEmpty(Filter))
            {
                wheresb.Append("where "+ Filter);
            }
            sqlsb.Append("select count("+pk+") as recordcount from "+tableName+" "+ wheresb+";" );
            if(string.IsNullOrEmpty(sort))
            {
                sort = pk + " desc";
            }
            if (pageNumber < 1)
            {
                pageNumber = 1;
            }
           
 
                string startid = ((pageNumber - 1) * pageSize + 1).ToString();
                string endid = (pageNumber * pageSize).ToString();
                sqlsb.Append("select * from (select " + Fields + ",row_number() over( order by " + sort + ") as rownum from " + tableName + " " + wheresb + ") as T  where rownum between "+startid+" and "+endid);
                DataSet ds = new DataSet();
                if (pars != null)
                {
                 ds=  SqlHelper.ExecuteDataset(CommandType.Text, sqlsb.ToString(), pars);
                }
                else
                {
                  ds=  SqlHelper.ExecuteDataset( sqlsb.ToString());
                }
                recordCount =(int)ds.Tables[0].Rows[0]["recordcount"];
            
                 ds.Tables[1].Columns.Remove("rownum");
                 return ds.Tables[1];

        }