SQL Server 2008将多值参数或参数数组传递给存储过程

Question

I have two tables tbl_Properties and tbl_Locations

tbl_Properties has list of properties (including FK Location_Id) tbl_Location has a list of locations

I am using following stored procedure to search properties in a location:

spPropGetSearch

(
@Location_Id int
)

AS

SELECT
P.Prop_Id,
P.Prop_Title,
P.Prop_Bedrooms,
P.Prop_Price,
L.Location_Title

FROM 
tbl_Properties P
INNER JOIN tbl_Locations L ON L.Location_Id = P.Location_Id

WHERE
(P.Location_Id = @Location_Id OR @Location_Id = '0')
ORDER BY P.Prop_DateAdded DESC

I pass location_id (such as '1002') and it works just fine and returns properties located within that location / area. Now, I want to pass multiple location_Ids such as '1002', '1005', '1010' to search properties located in all of those areas.

How would I do that? I will appreciate a detailed reply as I am not a database expert.

I found the following example and it's working fine. Please can you look into and check if there's any vulnerability

USE AdventureWorks2012
GO
CREATE PROCEDURE usp_Employeelist
@Cities NVARCHAR(30)
AS
DECLARE @CitiesXML AS XML
SET @CitiesXML = cast(('<a>'+replace(@Cities,',' ,'</a><a>')+'</a>') AS XML)

SELECT
BusinessEntityID
, FirstName
, JobTitle
, City
FROM HumanResources.vEmployee
WHERE City IN
(
SELECT
A.value('.', 'varchar(max)')
FROM @CitiesXML.nodes('A') AS FN(A)
)
ORDER BY BusinessEntityID
GO

--Execute the stored procedure using multiple values
--through one parameter in this stored procedure
USE AdventureWorks2012
GO
EXEC usp_Employeelist
'Cambridge,Newport Hills,Berlin,Bordeaux'
GO 

Answer 1

Use table-valued parameters . The first step is to create your type:

CREATE TYPE dbo.ListOfInt AS TABLE (Value INT);

I tend to use generic names for these to allow for reuse without any confustion as to names (eg if you named it LocationIDs it would then become confusing to store a list of properties in the type).

Then you can reference this type in your stored procedure:

CREATE PROCEDURE dbo.spPropGetSearch @LocationIDs dbo.ListOfInt READONLY
AS
BEGIN

    SELECT  P.Prop_Id,
            P.Prop_Title,
            P.Prop_Bedrooms,
            P.Prop_Price,
            L.Location_Title
    FROM    tbl_Properties P
            INNER JOIN tbl_Locations L 
                ON L.Location_Id = P.Location_Id

    WHERE   P.Location_Id IN (SELECT Value FROM @LocationIDs)
    OR      @Location_Id = 0
    ORDER BY P.Prop_DateAdded DESC;
END

You can then call this using something like:

DECLARE @LocationIDs dbo.ListOfInt;
INSERT @LocationIDs (Value)
VALUES (1002), (1005), (1010);
EXECUTE dbo.spPropGetSearch @LocationIDs;

EDIT

Found the error, it was here:

OR      @Location_Id = 0

Which leads me on to a new point, it looks like you want to have an option to return everything if 0 is passed. I would do this using IF/ELSE :

CREATE PROCEDURE dbo.spPropGetSearch @LocationIDs dbo.ListOfInt READONLY
AS
BEGIN
    IF EXISTS (SELECT 1 FROM @LocationIDs)
    BEGIN
        SELECT  P.Prop_Id,
                P.Prop_Title,
                P.Prop_Bedrooms,
                P.Prop_Price,
                L.Location_Title
        FROM    tbl_Properties P
                INNER JOIN tbl_Locations L 
                    ON L.Location_Id = P.Location_Id
        WHERE   P.Location_Id IN (SELECT Value FROM @LocationIDs)
        ORDER BY P.Prop_DateAdded DESC;
    END
    ELSE
    BEGIN
        SELECT  P.Prop_Id,
                P.Prop_Title,
                P.Prop_Bedrooms,
                P.Prop_Price,
                L.Location_Title
        FROM    tbl_Properties P
                INNER JOIN tbl_Locations L 
                    ON L.Location_Id = P.Location_Id
        ORDER BY P.Prop_DateAdded DESC;
    END
END
GO

So if the table valued parameter passed is empty, it will return all records, if it contains records it will only contain the location_ids supplied. Putting OR in queries like this makes it almost impossible for SQL Server to use an appropriate index.

---

ADDENDUM

---

To answer the comment

instead of using: IF EXISTS (SELECT 1 FROM @LocationIDs) how can we use OR condition in WHERE clause

My answer would be don't I suggested using IF/ELSE for a reason, not to over complicate things, but to improve performance. I had hoped to deter you from this approach when I said "Putting OR in queries like this makes it almost impossible for SQL Server to use an appropriate index." .

You could rewrite the query as follows:

SELECT  P.Prop_Id,
        P.Prop_Title,
        P.Prop_Bedrooms,
        P.Prop_Price,
        L.Location_Title
FROM    tbl_Properties P
        INNER JOIN tbl_Locations L 
            ON L.Location_Id = P.Location_Id
WHERE   P.Location_Id IN (SELECT Value FROM @LocationIDs)
OR      NOT EXISTS (SELECT 1 FROM @LocationIDs)
ORDER BY P.Prop_DateAdded DESC;

The problem with this approach is, you really have two options in the same query, and these options are likely to need two different exection plans. If you have an index on p.Location_ID , and you have records in @LocationIDs , then the best query plan is to use an index seek on tbl_Properties.Location_ID . If @LocationIDs is empty, then the index seek is pointless and the best plan is a clustered index scan (table scan) on tbl_Properties . Since SQL Server uses cached plans, it can only cache on or the other, which means that if it stores the index seek option, every time you pass an empty table you have a sub-optimal plan, or alternatively, if it caches the table scan plan, every time you pass values for location ID you are not taking advantage of the index that is there.

One workaround is OPTION (RECOMPILE) :

SELECT  P.Prop_Id,
        P.Prop_Title,
        P.Prop_Bedrooms,
        P.Prop_Price,
        L.Location_Title
FROM    tbl_Properties P
        INNER JOIN tbl_Locations L 
            ON L.Location_Id = P.Location_Id
WHERE   P.Location_Id IN (SELECT Value FROM @LocationIDs)
OR      NOT EXISTS (SELECT 1 FROM @LocationIDs)
ORDER BY P.Prop_DateAdded DESC
OPTION (RECOMPILE);

This forces the query to be recompiled for ever execution to ensure you have the optimal plan for the current execution. But since you only really have two options, this is a lot of unnessecary recompilation. So the best option is to have two queries, each with it's own cached execution plan, and using the IF/ELSE flow operator to flow to the appropriate query based on what has been passed as @LocationIDs .

Answer 2

     spPropGetSearch

        (
        @Location_Id varchar(500)
        )

        AS



DECLARE @strQuery varchar(MAX)
SET @strQuery='

        SELECT
        P.Prop_Id,
        P.Prop_Title,
        P.Prop_Bedrooms,
        P.Prop_Price,
        L.Location_Title

        FROM 
        tbl_Properties P
        INNER JOIN tbl_Locations L ON L.Location_Id = P.Location_Id

        WHERE
     P.Location_Id in ('+ @Location_Id+') OR @Location_Id = ''0''
        ORDER BY P.Prop_DateAdded DESC'

EXEC (@strQuery)

pass parameter in stored Procedure like as

EXEC spPropGetSearch '1002,1005,1010'

Answer 3

Use dynamic qry.

create procedure  dropsp
@no varchar(100)
as
    begin 
        declare @nsql  nvarchar(1000)

        Set @nsql   = ' SELECT  *
                        FROM    db.dbo.tmptable
                        WHERE no in  (' + @no +')'

        exec  sp_executesql @nsql 
    end 
go
exec dropsp  'aaaaaaaa,bbbb'