将操作数作为sql参数传递

Question

I am currently working on an asp.net application that has sql server 2008 as its backend. I want to give the user the ability to specify what they want to filter by on the SQL statement. On the interface I am giving them the option to select the following as a dropdown: equals to greater than Less than etc

I want to pass this as a parameter on the sql query to be executed. How best can I achieve this?

for eg;

Select amount, deduction, month from loan where amount @operant 10000;

the @operand is the return values of the above dropdown which is = < > <= >=

Answer 1

Assuming all positive integers < 2 billion, this solution avoids multiple queries and dynamic SQL. OPTION (RECOMPILE) helps thwart parameter sniffing, but this may not be necessary depending on the size of the table, your parameterization settings and your "optimize for ad hoc workload" setting.

WHERE [Amount] BETWEEN 
CASE WHEN @operand LIKE '<%' THEN 0
     WHEN @operand = '>' THEN @operant + 1
     ELSE @operant END
AND
CASE WHEN @operand LIKE '>%' THEN 2147483647
     WHEN @operand = '<' THEN @operant - 1
     ELSE @operant END
OPTION (RECOMPILE);

Answer 2

I would write few "IF" statements. Code is not very short, but should be fast.

IF(@operand = '=')
Select..
ELSE IF(@operand = '>=')
Select..
...

Also, i would say, that Top (@someRowCount) could be great idea.

Answer 3

You need dynamic sql for this scenario

For your example this can be

DECLARE @sql AS nvarchar(max) -- Use max if you can, if you set 
  -- this to a specific size then your assignment later can be 
  -- truncated when maintained and still be valid.

SET @sql = 'Select amount, deduction, month from dbo.loan where amount ' 
  + @operand + ' 10000'

EXEC sp_executesql @sql

Update 1

There are 2 ways to execute dynamic sql : Exec() and sp_executesql

Read the comments why sp_executesql is preferred (still, beware of sql injections!)

I also prefix the table with the dbo so that the execution plan can be cached between different users

More info in the awesome paper at http://www.sommarskog.se/dynamic_sql.html#queryplans