sql入参

//防SQL注入攻击
            var parms = new
            {
                userId = userId,
                pwd = pwd
            };
            //DynamicParameters parms = new DynamicParameters();
            //parms.Add("userId", userId);
            //parms.Add("pwd", pwd);
            var res = SqlHelperRead.GetModel<UserEx>(sql, parms);

 SqlParameter[] pms = new SqlParameter[]
            {
                new SqlParameter("@image",SqlDbType.Image){Value= data},
            };