请教sql语句拼接的问题 - .NET技术 / C#

例如我现在在数据库中有这么几条数据:学号,姓名,班级,班主任ID,出生日期
我在查询学生信息界面中要求可以根据以上5条数据中的任意一项或多项查询出数据
我自己写的sql语句拼接如下:
C# code:

string strsql = "select * from stu where ";
if (stuNum != "")
{
strsql += "stuNum like '%" + stuNum + "%' and ";
}
else
{
strsql += "stuNum like '%%' and ";
}
if (stuName != "")
{
strsql += "stuName ='" + stuName + "' and ";
}
if (beginDate != "")
{
strsql += "createdate>=to_date('" + beginDate + " 00:00:00 " + "','yyyy-mm-dd hh24:mi:ss')" + " and ";
}
if (endDate != "")
{
strsql += "createdate<=to_date('" + endDate + " 23:59:59 " + "','yyyy-mm-dd hh24:mi:ss')" + " and ";
}
if (type != "")
{
strsql += "type ='" + type + "' and ";
}
if (consumer != "")
{
strsql += &qu