将比较运算符作为参数传递给SQL查询

Question

Is there is anyway to pass comparison operator to MySQL query as parameter?

Let's say I have this query

SELECT * FROM `table1` WHERE `column1` > @p

And instead of > I want to be able to pass < or = depending on condition. I can use string.format() , but I want my query to be parametrized.

And I don't want to use predefined queries, as long as they differ only in one operator.

Answer 1

Try this:

SELECT * FROM `table1`
    WHERE (`column1` > @p and @condition = 1)
        or (`column1` = @p and @condition = 0)
        or (`column1` < @p and @condition = -1)

Answer 2

MySQL prepared statements only support binding values for variables. Replacing arbitrary part of query string (even for table names) is not supported. In other words, you will have to construct your SQL dynamically on a client.

Answer 3

Unfortunately that can't be done in order to prevent SQL injection.

But I can give you an idea(workaround) on how to do it:

SELECT * FROM `table1` WHERE (`column1` > @p AND @op='>') OR (`column1` = @p AND @op='=') OR ........

So you can pass the operator to @op parameter from your code.

It should be better to use a "switch case" for this kind of operations to prevent SQL injection.

Answer 4

Try this:

SET @MyQuery := CONCAT("SELECT * FROM table1 WHERE",@P);
PREPARE stmt1 FROM @MyQuery;
EXECUTE stmt1;
DEALLOCATE PREPARE stmt1;

And for @P:

SET @P:= "> 1" OR SET @P:="=1" or other condition you need to put it