在 exec sp_executesql 中从 proc 获取标量值

Question

I have a proc that returns a different numeric value for different conditions. And I call to this proc from the exec sp_executesql But all the time I get 0 . What I didn't do in the correct code is why it doesn't work for me, can anyone help?

Stored procedure:

ALTER PROCEDURE [dbo].[AAAProc](
@Field1 INT, @Field2 INT = null, @FileName NVARCHAR(MAX))
AS
BEGIN

SET NOCOUNT ON;

DECLARE @DestFile NVARCHAR(MAX)
declare @p1 int = 100
declare @p2 int = 500
SELECT  @DestFile = dbo.Func1(@p1, @p2)

DECLARE @CmdString VARCHAR(1000)
DECLARE @MyTable TABLE
(
  Line NVARCHAR(1000)
)

SET @CmdString = 'copy '+@FileName+' '+ @DestFile

print @CmdString

if(dbo.FileExists(@FileName)=1)
begin
    INSERT INTO @OutputTable EXEC master..xp_cmdshell @CmdString 

    if ((select count(*) from @MyTable where Line like '%1 file(s) copied.%')>0)
    begin
        RETURN 1;
    end
    ELSE
    begin
        return 0;
        declare @error nvarchar(max) = '!!!!Error!!!!! move file failed'
        RAISERROR (@error,16,1);
    end
end
else
begin
    RETURN 0;
end
END

And this is the call statment:

SET @Sql = 'EXEC dbo.AAAProc '+@SomeField1+','+CONVERT(NVARCHAR(MAX), @SomeField2)+', ' + ISNULL(CONVERT(NVARCHAR(MAX), @SomeField3),'null')+', '''+  @SomeField4+'''';
declare @result int
EXEC @result = sp_executesql @Sql

PRINT '@result = ' + CONVERT(NVARCHAR,@result)

Answer 1

sp_executesql is used to avoid string concatenation, passing values as parameters instead. No amount of quoting or escaping can prevent SQL injection and conversion issues. By using string concatenation, the question's code is fully exposed to those problems.

In this case though, one can just call EXEC directly, pass the parameters and store the return value:

declare @ret int;
EXEC @ret = dbo.AAAProc @SomeField1 ,@SomeField2,ISNULL(@SomeField3),'null');

Which is equivalent to :

declare @someValue varchar(max)=ISNULL(@SomeField3,'null');

declare @ret int;
EXEC @ret = dbo.AAAProc @SomeField1 ,@SomeField2,@someValue;

The stored procedure only accepts 3 parameters, so passing @SomeField4 is probably a bug hidden by the string concatenation.

Should there be a need to call sp_executesql ( why ?) the same statement can be used provided @ret is defined as an output parameter for the sp_executesql call. Everything else should be passed as a parameter. That means, NO functions inside the string, and everything else should be declared as a parameter to sp_executesql :

declare @ret int

exec sp_executesql N'EXEC @ret = dbo.AAAProc @Field1 ,@Field2,@FileName',
     N'@Field1 INT, @Field2 INT, @FileName varchar(max), @ret int OUTPUT',
     @Field1=@SomeField1,
     @Field2=@SomeField2,
     @FileName=ISNULL(@SomeField3,'null')
     @ret = @ret OUTPUT 

ISNULL is called outside the query string, when passing the parameter value.

Answer 2

With your script, the @result variable holds the result from sp_executesql execution, not the result from your stored procedure. If I understand your case correctly, you need to get the result from your stored procedure in the following way (note, that the result from execution is always an integer and an output parameter is also an option in your case):

DECLARE @sql nvarchar(max)
SET @Sql = 'EXEC @rc = dbo.AAAProc '+ @SomeField1 + ',' + CONVERT(NVARCHAR(MAX), @SomeField2)+', ' + ISNULL(CONVERT(NVARCHAR(MAX), @SomeField3),'null');

DECLARE @result int
DECLARE @rc int
EXEC @result = sp_executesql @sql, N'@rc int OUTPUT', @rc OUTPUT

IF @result = 0  
    PRINT 'Result = ' + CONVERT(NVARCHAR, @rc)
ELSE 
    PRINT 'Error'

Note, that you need to call your procedure using parameters, without string concatenations, to prevent SQL injection attacks:

DECLARE @sql nvarchar(max)
SET @Sql = 'EXEC @rc = dbo.AAAProc @SomeField1, @SomeField2, @SomeFileName';

DECLARE @result int
DECLARE @rc int
DECLARE @SomeField1 int 
DECLARE @SomeField2 int
DECLARE @SomeFileName nvarchar(max)

-- Set values for parameters

EXEC @result = sp_executesql 
                    @sql, 
                    N'@rc int OUTPUT, @SomeField1 int, @SomeField2 int, @SomeFileName nvarchar(max)', 
                    @rc OUTPUT, @SomeField1, @SomeField2, @SomeFileName

PRINT @result

IF @result = 0  
    PRINT 'Result = ' + CONVERT(NVARCHAR, @rc)
ELSE 
    PRINT 'Error'