How to prepare and execute multiple statements in MySQL?

Question

I have a stored procedure on MySQL db that I use to update my records. Based on the inputs, either, add hours to a column, or subtract hours to a column. I call this SP using the Appian smart service for store procedures. My problem is, that if tried to do both, add and subtract (for different rows) then the store procedure doesn't do anything. It runs in my process model fine but the DB is not updated. If I run the PM with a only one input(either add or subtract) then it updates the db accordingly. Could anyone tell me what I'm doing wrong in my SP? Note: addAttendeeUsername and removeAttendeeUsername inputs are both VARCHAR's strings delimited by commas

    BEGIN

    DECLARE startTime datetime;
    DECLARE SQLStateCode varchar(5) DEFAULT '00000';
    DECLARE ErrorNumber int;
    DECLARE MessageText varchar(1000);

    -- insert / update

    set @sql = concat("UPDATE
      XCS_APP_CERTIFICATION
    SET
      COMPLETED_HOURS = COMPLETED_HOURS + ", courseHours , ",
      LAST_MODIFIED_BY = '", lastModifiedBy, "',
      LAST_MODIFIED_ON = NOW()
    WHERE
    XCS_APP_CERTIFICATION.CREATED_BY in (" , addAttendeeUsername , ") AND VALID_START_DATE <= '", offeringEndDateTime, "'
      AND GRACE_PER_END_DATE >= '", offeringEndDateTime,"' ");


    set @sql2 = concat("UPDATE
      XCS_APP_CERTIFICATION
    SET
      COMPLETED_HOURS = COMPLETED_HOURS - ", courseHours, ",
      LAST_MODIFIED_BY = '", lastModifiedBy, "',
      LAST_MODIFIED_ON = NOW()
    WHERE
      CREATED_BY IN (", removeAttendeeUsername, ")  AND VALID_START_DATE <= '", offeringEndDateTime, "'
      AND GRACE_PER_END_DATE >= '", offeringEndDateTime, "' ");

        PREPARE stmt FROM @sql;
        EXECUTE stmt;


        PREPARE stmt2 FROM @sql2;
        EXECUTE stmt2;

    set successFlag = 1;

    -- committing transaction
    COMMIT;

    END

Answer 1

It's not clear because you haven't provided the procedure argument declaration, but I would guess addAttendeeUsername and removeAttendeeUsername are strings. But you don't use quotes around them in your SQL syntax. So they'll be interpreted as column names, which are no doubt not found.

You really should be combining input variables using query parameters, NOT concatenating them into your SQL.

set @sql = concat("UPDATE
  XCS_APP_CERTIFICATION
SET
  COMPLETED_HOURS = COMPLETED_HOURS + ?
  LAST_MODIFIED_BY = ?,
  LAST_MODIFIED_ON = NOW()
WHERE
XCS_APP_CERTIFICATION.CREATED_BY in (?) AND VALID_START_DATE <= ?
  AND GRACE_PER_END_DATE >= ? ");

SET @courseHours = courseHours, 
    @lastModifiedBy = lastModifiedBy,
    @addAttendeeUsername = addAttendeeUsername,
    @offeringEndDateTime = offeringEndDateTime;

PREPARE stmt FROM @sql;
EXECUTE stmt USING @courseHours, @lastModifiedBy,@addAttendeeUsername, 
  @offeringEndDateTime, @offeringEndDateTime;

When you EXECUTE , you must use session variables (the kind with @ sigil), not local variables.