SQL Stored Procedure with column name as variable

Question

I really think this is a simple fix, but I didn't find any solution on the Internet (at least none I could understand).

I have this stored procedure:

ALTER PROC [dbo].[GetCard](
    @Input varchar(50),
    @Input2 varchar(50)
)
AS
SELECT * FROM Main WHERE @Input = @Input2;

But when I go:

GetCard 'CardName', 'Text';

SQL doesn't quite understand that @Input is a column. What do I have to change? Does it need any special syntax?

Answer 1

Build your query string like so (think I've got the single quotes right), and execute it:

SET @qString = 'SELECT * FROM MAIN WHERE ' + QuoteName(@Input) + ' = ''' + @Input2 + ''''

exec(@qString)

Simple fiddle demo

As Roman pointed out, be exceedingly careful with dynamic sql. Read up on SQL injection.

Answer 2

It is better to use dymamic SQL as Andrew or Roman Czerwinski recommended. But if you don't want to use dynamic SQL then you can use this logic:

ALTER PROC [dbo].[GetCard](
    @Input varchar(50),
    @Input2 varchar(50)
)
AS
SELECT * 
FROM Main 
WHERE CardName  = case when @Input = 'CardName'    then @Input2 else CardName    end
and OtherColumn = case when @Input = 'OtherColumn' then @Input2 else OtherColumn end
--etc...

Answer 3

In your code sample there is no column or parameter or variable with the name @Input1.