SQL dynamic query returns NULL

Question

I'm trying to build a dynamic query with dynamic order by condition. But some reason the adhoc query works fine but the same using with sp_executesql returns null. Please advice if anything wrong with the query. Below is the sample data.

   create table resource_statistics (id int , parameter_name varchar(255), parameter_value INT) 
    
    INSERT INTO resource_statistics values (1,'temparature',28);
    INSERT INTO resource_statistics values (2,'humidity',67)
    INSERT INTO resource_statistics values (3,'wind',5)
    INSERT INTO resource_statistics values (4,'wind',28)
    INSERT INTO resource_statistics values (5,'humidity',90)
    INSERT INTO resource_statistics values (6,'humidity',45)
    INSERT INTO resource_statistics values (7,'temparature',38)

Below query returns the correct data set if ! switch the @tvalue with 0 and 1.

declare @test varchar(255)='parameter_name', @tvalue INT=0
select 
parameter_name,parameter_value
from
resource_statistics
ORDER BY 
CASE WHEN @test = 'parameter_name' THEN CASE @tvalue when '1' THEN   parameter_name ELSE NULL END END DESC

Tried to convert the above query to dynmic SQL but on execution results where empty.

declare @test varchar(255)='parameter_name', @tvalue INT=0,@sqlquery NVARCHAR(MAX)
SET @sqlquery='
select 
parameter_name,parameter_value
from
resource_statistics
ORDER BY ' +
CASE WHEN  @test  ='parameter_name' THEN CASE @tvalue  when '1' THEN   'parameter_name' ELSE NULL END END +' DESC'
select @sqlquery
execute sp_executesql @sqlquery

Answer 1

Don't use else NULL . Just use else '' :

declare @test varchar(255) = 'parameter_name',
        @tvalue INT = 0,
        @sqlquery NVARCHAR(MAX);

SET @sqlquery = N'
select parameter_name, parameter_value
from resource_statistics
order by ' +
    (case when  @test = 'parameter_name' and @tvalue = '1' 
          then 'parameter_name'  + ' DESC' else '' end)
select @sqlquery;

execute sp_executesql @sqlquery;

You probably already know that incorporating parameters into a SQL query like this is both a risk for unexpected syntax errors and for SQL injection. However, you are getting NULL because + returns NULL if either operand is NULL .

Answer 2

Your dynamic query cannot be executed as it does not formed properly. I just corrected the issue of forming the dynamic statement.

 declare @sqlquery NVARCHAR(MAX)
  SET @sqlquery='
  declare @test varchar(255)=''parameter_name'', @tvalue INT=0

   select 
    parameter_name,parameter_value
  from  resource_statistics
  ORDER BY 
    CASE WHEN  @test  =''parameter_name'' THEN CASE @tvalue  when ''1'' THEN   
              ''parameter_name'' ELSE NULL END END DESC'
   select @sqlquery
   execute sp_executesql @sqlquery