替代TSQL

此查詢效果很好，因爲您可以看到我必須在@SearchCriteria和查詢的其餘部分之間進行拆分，因爲它是varchar。如果我強制，語法運作良好，但它沒有返回任何東西，當你查詢可能，因爲額外'替代TSQL

你能幫忙嗎？

ALTER PROCEDURE [dbo].[sp_rte_GetRateList] 
(
    @TenantID  INT, 
    @CustomerID  BIGINT = -1, 
    @SearchCriteria VARCHAR(64) = '', 
    @SortBy   VARCHAR(16) = '', 
    @SortType  VARCHAR(16) = '', 
    @Debug   BIT = 0 
) 
AS 
BEGIN 
    SET NOCOUNT ON; 

    DECLARE @sql nvarchar(4000), 
      @paramlist nvarchar(4000) 

    IF (@SearchCriteria = '') 
    BEGIN 
     SELECT @sql = 'SELECT r.TenantID, r.RateID, r.RateGUID, r.RateCode, r.RateName, r.RateDescription, r.ValidityUTCDate, r.CreatedUTCTimeStamp, 
          r.CreatedIP, r.CreatedBy, r.LastModifiedUTCTimeStamp, r.LastModifiedIP, r.LastModifiedBy, r.IsActive, 
          c.CustomerID, c.CustomerName, rt.RateTypeID, rt.RateTypeName, s.SupplierID, s.SupplierName, r.FixedLineAmount, r.MobileAmount, r.DataAmount, r.OtherAmount, 
          (r.FixedLineAmount + r.MobileAmount + r.DataAmount + r.OtherAmount) AS TotalAmount, 
          r.CreatedUTCTimeSTamp, 
          STUFF((SELECT '', '' + ct.CustomerTypeName 
            FROM glb_CustomerTypes ct JOIN glb_CustomerCustomerTypes cct ON cct.CustomerTypeID = ct.CustomerTypeID 
            WHERE cct.CustomerID = C.CustomerID 
            GROUP BY ct.CustomerTypeName FOR XML PATH('''')), 1, 2, '''') AS CustomerTypeName 
         FROM dbo.rte_Rates r 
           INNER JOIN dbo.rte_RateTypes rt ON r.RateTypeID = rt.RateTypeID 
           INNER JOIN dbo.glb_Suppliers s ON r.SupplierID = s.SupplierID 
           INNER JOIN dbo.glb_Customers c ON r.CustomerID = c.CustomerID 
           INNER JOIN dbo.glb_Addresses a ON c.CustomerID = a.CustomerID 
           INNER JOIN dbo.glb_AddressTypes at ON a.AddressTypeID = at.AddressTypeID 
         WHERE at.AddressTypeCode = ''GLB_ADT_PHYSCLDDRS'' AND 
           r.TenantID = @xTenantID AND 
           rt.TenantID = @xTenantID AND 
           s.TenantID = @xTenantID AND 
           r.IsActive = 1 AND 
           rt.IsActive = 1 AND 
           c.IsActive = 1 AND 
           c.CustomerID = @xCustomerID ' 
    END 
    ELSE 
    BEGIN 
     SELECT @sql = 'SELECT r.TenantID, r.RateID, r.RateGUID, r.RateCode, r.RateName, r.RateDescription, r.ValidityUTCDate, r.CreatedUTCTimeStamp, 
          r.CreatedIP, r.CreatedBy, r.LastModifiedUTCTimeStamp, r.LastModifiedIP, r.LastModifiedBy, r.IsActive, 
          c.CustomerID, c.CustomerName, rt.RateTypeID, rt.RateTypeName, s.SupplierID, s.SupplierName, r.FixedLineAmount, r.MobileAmount, r.DataAmount, r.OtherAmount, 
          (r.FixedLineAmount + r.MobileAmount + r.DataAmount + r.OtherAmount) AS TotalAmount, 
          r.CreatedUTCTimeSTamp, 
          STUFF((SELECT '', '' + ct.CustomerTypeName 
            FROM glb_CustomerTypes ct JOIN glb_CustomerCustomerTypes cct ON cct.CustomerTypeID = ct.CustomerTypeID 
            WHERE cct.CustomerID = C.CustomerID 
            GROUP BY ct.CustomerTypeName FOR XML PATH('''')), 1, 2, '''') AS CustomerTypeName 
         FROM dbo.rte_Rates r 
           INNER JOIN dbo.rte_RateTypes rt ON r.RateTypeID = rt.RateTypeID 
           INNER JOIN dbo.glb_Suppliers s ON r.SupplierID = s.SupplierID 
           INNER JOIN dbo.glb_Customers c ON r.CustomerID = c.CustomerID 
           INNER JOIN dbo.glb_Addresses a ON c.CustomerID = a.CustomerID 
           INNER JOIN dbo.glb_AddressTypes at ON a.AddressTypeID = at.AddressTypeID 
         WHERE at.AddressTypeCode = ''GLB_ADT_PHYSCLDDRS'' AND 
           r.TenantID = @xTenantID AND 
           rt.TenantID = @xTenantID AND 
           s.TenantID = @xTenantID AND 
           r.IsActive = 1 AND 
           rt.IsActive = 1 AND 
           c.IsActive = 1 AND 
           c.CustomerID = @xCustomerID AND 
           (r.RateCode LIKE ''%' + @SearchCriteria + '%'' OR 
           r.RateName LIKE ''%' + @SearchCriteria + '%'' OR 
           rt.RateTypeName LIKE ''%' + @SearchCriteria + '%'' OR 
           r.RateDescription LIKE ''%' + @SearchCriteria + '%'' OR 
           s.SupplierCode LIKE ''%' + @SearchCriteria + '%'' OR 
           s.SupplierName LIKE ''%' + @SearchCriteria + '%'' OR 
           c.CustomerCode LIKE ''%' + @SearchCriteria + '%'' OR 
           c.CustomerName LIKE ''%' + @SearchCriteria + '%'' OR 
           c.CustomerDescription LIKE ''%' + @SearchCriteria + '%'') '      
    END 

    SELECT @sql = @sql + 'ORDER BY ' + @SortBy + ' ' + @SortType 

    IF (@Debug = 1) PRINT @sql 

    SELECT @paramlist = '@xTenantID INT, @xCustomerID BIGINT' 

    EXEC sp_executesql @sql, @paramlist, @TenantID, @CustomerID 
END

來源

2009-12-16 dcpartners

你可以只翻一番@SearchCriteria任何報價，但不會保護你免受一切形式的SQL注入的 - 這隻能通過獲取動態SQL遠做。

我不是100％確定你需要這個特定問題的動態SQL首先。

來源

2009-12-16 00:34:29

我想你會更好初始化@SearchCriteria爲NULL：

ALTER PROCEDURE [dbo].[sp_rte_GetRateList] 
( ... 
    @SearchCriteria  VARCHAR(64), --inits as NULL 
    .... 
) 

    IF @SearchCriteria IS NOT NULL 
    BEGIN 

     SET @SearchCriteria = REPLACE(@SearchCriteria, '''', '''''') 
     ... 
    END 
    ELSE 
     ...

我明白你爲什麼設置動態SQL你的方式 - 我注意到paramlist沒有@SearchCriteria在它，所以你不必定義@SearchCriteria的參數實例。當你有來自同一個表的2+列時，可能會考慮進行全文搜索 - 可能會更快，而且SQL更簡單。

來源

2009-12-16 01:34:45

回答

相關問題