存储过程不适用于动态 where 子句

Question

I have created a stored procedure that has a few select statements and the last where the condition is inside a @command. Since I am running this in C#.

CREATE PROCEDURE [dbo].[SearchList]  
    @command varchar(2000) 
AS
BEGIN
    SELECT * 
    FROM XYZ + CONVERT(varchar(2000), @command)
END

I keep getting an error

Conversion failed when converting the varchar value ' ORDER BY ID DESC' to data type int

DECLARE @return_value int

EXEC    @return_value = [dbo].[SearchList]
        @command = N' ORDER BY Id DESC'

SELECT  'Return Value' = @return_value
GO

The output returns a list which I then bind it in a grid.

Answer 1

You can try below solution

CREATE PROCEDURE SPName( @ColumnName varchar(100) ) AS
begin
SELECT * FROM XYZ
ORDER BY
  CASE WHEN @ColumnName='COl1' THEN @ColumnName 
       WHEN @ColumnName='COl2' THEN @ColumnName 
       WHEN @ColumnName='COl3' THEN @ColumnName 

END

Approach 2

CREATE PROCEDURE SPName( @ColumnName varchar(100)  ) AS
begin
SELECT * FROM XYZ
where 1=1 AND ( COL1= @ColumnName or isnull(@ColumnName ,'')='')
end

Or Use two separate variable for Where Clause and Order by and use combination of above

Answer 2

You can't mix dynamic SQL and regular SQL. You need to make the whole thing dynamic SQL:

create Procedure [dbo].[SearchList]  @command nvarchar(max) 
as begin
    declare @sql nvarchar(max);
    set @sql = N'
select *
from XYZ
' + @command;

    exec sp_executesql @sql;
end;