如何选择行值作为另一个表的列名？

Question

so i have a query that when i run gives me the names of the columns in another table. The table i am querying is the user's column configuration in our software. it can change from showing 3 to 20 columns. The table stores the names of the actual columns in the database. i then want to be able to take the data from that table and query the other table based only on those column names that were returned. i'm stumped on how to do it so that as i run the query for different users the query will catch only the columns they have saved in their config.

my first query:

SELECT field_name
FROM list_config
WHERE list_config.config_name = 'username'
  AND list_config.visible = 'Y';

returns the column names:

field_name (header)

create_date       
customer_id       
id                
update_date       
update_user_id    
short_description    
ops_note          
create_user_id    
resp_user_id      
activity_status_id

i then want to query the table work_order for only these columns produced by the first query.

i'm still new to SQL any help would be awesome. i've tried messing around with variables and some procedures but i just don't know enough at this point in time.

Answer 1

This is untested, however, this should get you what you are after:

DECLARE @SQL nvarchar(MAX);

SET @SQL = N'SELECT ' +
           STUFF((SELECT N',' + NCHAR(13) + NCHAR(10) +
                         N'       ' + QUOTENAME(field_name)
                  FROM list_config
                  WHERE list_config.config_name = 'username'
                    AND list_config.visible = 'Y'
                  --ORDER BY ??? --without an ORDER BY the order of the columns will be random/unpredictable
                  FOR XML PATH(N''),TYPE).value(N'.','nvarchar(MAX)'),1,10,N'') + NCHAR(13) + NCHAR(10) +
           N'FROM work_order;';
--PRINT @SQL; --your debugging best friend
EXEC sp_executesql @SQL;

If you need to pass parameters, then make sure you parametrise your sp_execute statement; do not inject the parameter values into your dynamic statement.

If you want to validate the the column names are real column names, you can use an EXISTS :

DECLARE @SQL nvarchar(MAX);

SET @SQL = N'SELECT ' +
           STUFF((SELECT ',' + NCHAR(13) + NCHAR(10) +
                         N'       ' + QUOTENAME(lc.field_name)
                  FROM list_config lc
                  WHERE lc.config_name = 'username'
                    AND lc.visible = 'Y'
                    AND EXISTS (SELECT 1
                                FROM INFORMATION_SCHEMA.COLUMNS C
                                WHERE C.COLUMN_NAME = lc.field_name
                                  AND C.TABLE_NAME = N'Work_order')
                  --ORDER BY ???
                  FOR XML PATH(N''),TYPE).value(N'.','nvarchar(MAX)'),1,10,N'') + NCHAR(13) + NCHAR(10) +
           N'FROM work_order;';
--PRINT @SQL; --your debugging best friend
EXEC sp_executesql @SQL;

How this answer works is that it builds a list of all the columns in a "delimited" format. The real "magic", is therefore in FOR XML PATH , so we'll going to start there with the subquery.

FOR XML PATH basically does what is says on the tin, it turns the result set into XML. We can use this functionality to concatenate all the values from the result set from the table work_order . I prefix (this is important) every value with N',' + NCHAR(13) + NCHAR(10) + N' ' . This might seem a bit strange (some only use ',' ), so I'll explain. the comma is the easy one, between each column name we need one of those. NCHAR(13) + NCHAR(10) is a carriage return (unicode character 13) and a line break (unicode character 10). Then we have some white space. I do this purely for formatting, as well formatted dynamic SQL is much easier to trouble shoot than poorly formatted.

Then we have STUFF . There STUFF is used to remove the first prefix for each value of field_name (this is why I said that it being the prefix is important). STUFF 's second parameter ( 1 in this case) is the position to start a replacement at, and the 3rd is how many characters to replace (so, characters 1 - 10). This final parameter is what to replace those characters with ( '' ). So that replaces the first prefix ( N',' + NCHAR(13) + NCHAR(10) + N' ' ) with '' .

Answer 2

This is another approach (This is untested)

declare @query nvarchar(1000) = ''

select @query = @query+',['+field_name+']'
FROM list_config
WHERE list_config.config_name = 'username'
  AND list_config.visible = 'Y';

 set @query =substring(@query,2,len(@query))

 set @query ='select '+@query + ' from work_order'

exec (@query)

you can build any kind of script with this