动态创建一个键值对，然后……然后

Question

Is it possible to create a key-value pair from an HTML radio button and text box value, then insert that pair into an array, then pass that array into a SQL Stored Procedure parameter that adds to the WHERE clause in the SP?

I am building a dashboard app that references one table in the SQL Server DB when it starts. This brings back the results of a simple select SP. I am pretty new to SQL so I am "psuedo-coding"(sorry)

   DECLARE @SelectedDate NVARCHAR(50)       
   SELECT * FROM Tablename WHERE log_ts > @SelectedDate

However at this point I need to be able to select between 1-4 field names and give them a value to filter by.

I would love to set up those field names as a radio button, and to prevent injection, screen those inputs against known values in my application before sending them to the server, including inserting default values of the input is null. My thought was to set up an array[string, string] once the screening is done, and pass that array into SQL as an array[field, value].(there would never be a null value).Here is what i would like the array to look like when being sent and all pairs are their default values:

   QueryArray = ["application_name","Mobile"]
                ["login_id","*"]
                ["log_ts","Datetime.Today"]
                ["error_level","Exception"]

Then somehow pass it into the where clause like this:

   SELECT * 
   FROM TableName
   WHERE [application_name] = [Mobile]
     AND [login_id]=[*]
     AND [log_ts]=[Datetime.Today] 
     AND [error_level]=[Exception]

This is where my brain looks normally for a for-each or something, but SQL if pretty new to me... Any help would be greatly appreciated, even if its just a link to a previous article that I could not find...

Answer 1

It sounds like you want to use nullable parameters in conjunction with the coalesce operator. This works well if you have a known set of parameters, and then want to filter against them. So if you know all the possible fields you can search on, which is assuming you know ahead what fields you will display on your UI for people to filter with , then you can actually make a procedure like so:

create procedure [dbo].[MySampleProcedure]
    @Property1Value <yourDataType> = null,
    @Property2Value <yourDataType> = null,
    ....
as
begin
     select
          Col1,
          Col2,
          ...
     from
         [dbo].[YourTable]
     where
         Column1Value = coalesce(@Property1Value, Column1Value)
         and Column2Value = coalesce(@Property2Value, Column2Value)
         ....
end

This effectively means that if you omit certain parameters, you can still match based on the parameters you provide. When you receive your set from the UI, you can then match the pairs to parameters and you're off to the races.

If your field names are dynamic (not known ahead of time), then it becomes a more difficult issue. In that case, you will likely have to drop to dynamic SQL to accomplish what you want, and construct a query using parameterized SQL, to avoid injection attempts.