SQL Server：如何在存储过程中设置动态列名

Question

我对动态过程还很陌生，希望这里的人可以为我提供以下帮助。

看来我的问题出在我的Where子句的AND部分。 我在这里没有收到错误-它只是不返回任何结果。

编辑：我的动态列名称将为“ R. @ searchCategory”。

到目前为止，我的程序：

ALTER PROCEDURE [dbo].[FetchRequests]
    @searchCategory nvarchar(100) = '',
    @searchTerm nvarchar(256) = ''
AS
BEGIN
    BEGIN   

    DECLARE @sql nvarchar(max)  
    SET @sql = 'SELECT TOP 100
                R.logID,
                R.flag,
                R.reviewer,
                R.modBy,
                A.Email AS requesterEmail,
                B.Email AS approverEmail,
                L.locale AS region,
                L.country AS countryName
    FROM        LogRequests R
    LEFT JOIN   EmpTable A
    ON          A.NTID = R.requester
    LEFT JOIN   EmpTable B
    ON          B.NTID = R.approver
    INNER JOIN   Locales_Countries L
    ON          R.country = L.isoCode
    WHERE       (R.logStatus LIKE ''%Completed%'' OR R.logStatus LIKE ''%Closed%'') 
    AND         R.' + @searchCategory + ''' LIKE ''%' + @searchTerm + '%''
    ORDER BY    R.dateNeeded desc, R.dateRec desc, R.prio desc, R.EID desc
    FOR XML PATH(''requests''), ELEMENTS, TYPE, ROOT(''ranks'')'

    EXEC(@sql)

    END
END

谢谢你，迈克。

Answer 1

您的AND陈述式中的引号过多...

做这个：

AND         R.' + @searchCategory + ''' LIKE ''%' + @searchTerm + '%''

像这样：

AND         R.' + @searchCategory + ' LIKE ''%' + @searchTerm + '%''

结果：

DECLARE @sql nvarchar(max), @searchCategory nvarchar(max), @searchTerm nvarchar(max)

set @searchCategory = 'something'
set @searchTerm = 'to look for'

    SET @sql = 'SELECT TOP 100
                R.logID,
                R.flag,
                R.reviewer,
                R.modBy,
                A.Email AS requesterEmail,
                B.Email AS approverEmail,
                L.locale AS region,
                L.country AS countryName
    FROM        LogRequests R
    LEFT JOIN   EmpTable A
    ON          A.NTID = R.requester
    LEFT JOIN   EmpTable B
    ON          B.NTID = R.approver
    INNER JOIN   Locales_Countries L
    ON          R.country = L.isoCode
    WHERE       (R.logStatus LIKE ''%Completed%'' OR R.logStatus LIKE ''%Closed%'') 
    AND         R.' + @searchCategory + ' LIKE ''%' + @searchTerm + '%''
    ORDER BY    R.dateNeeded desc, R.dateRec desc, R.prio desc, R.EID desc
    FOR XML PATH(''requests''), ELEMENTS, TYPE, ROOT(''ranks'')'

    print @sql

我总是打印我的动态sql ...，然后将输出复制到新窗口中，以查看是否有任何不应该的转义。

注意：请研究SQL注入攻击，并使用sp_executeSQL-EXEC是不明智的做法。

Answer 2

在我发布时，已经有了另一个正确的答案：您在@sql定义中添加了太多的单引号。

捕获这些简单错误的一种方法是添加print @sql这样您可以在尝试执行查询之前查看查询的读取方式。 我将其包含在下面的修改脚本中：

ALTER PROCEDURE [dbo].[FetchRequests]
    @searchCategory nvarchar(100) = '',
    @searchTerm nvarchar(256) = ''
AS
BEGIN
    BEGIN   

    DECLARE @sql nvarchar(max)  
    SET @sql = 'SELECT TOP 100
                R.logID,
                R.flag,
                R.reviewer,
                R.modBy,
                A.Email AS requesterEmail,
                B.Email AS approverEmail,
                L.locale AS region,
                L.country AS countryName
    FROM        LogRequests R
    LEFT JOIN   EmpTable A
    ON          A.NTID = R.requester
    LEFT JOIN   EmpTable B
    ON          B.NTID = R.approver
    INNER JOIN   Locales_Countries L
    ON          R.country = L.isoCode
    WHERE       (R.logStatus LIKE ''%Completed%'' OR R.logStatus LIKE ''%Closed%'') 
    AND         R.' + @searchCategory + ' LIKE ''%'' + @searchTerm + ''%''
    ORDER BY    R.dateNeeded desc, R.dateRec desc, R.prio desc, R.EID desc
    FOR XML PATH(''requests''), ELEMENTS, TYPE, ROOT(''ranks'')'

    --print @sql
    EXEC(@sql)

    END
END