List<SqlParameter> paras = new List<SqlParameter>();
                
                if (!string.IsNullOrEmpty(ciName))
                {
                    sql += " and ci_name like @ciName "; 
                    paras.Add(new SqlParameter("@ciName", "%"+ciName+"%"));
                }

SqlParameter[] param = paras.ToArray();

string sql = "SELECT StudentID,StudentNO,StudentName FROM Student WHERE StudentName like %@StudentName%";

paras.Add(new SqlParameter("@StudentName", "%"+StudentName+"%"));