SQL查询的单引号R

Question

您好，我要通过R连接将以下数据粘贴到SQL查询中。

UKWinnersID<-c("1W167X6", "QM6VY8", "ZDNZX0", "8J49D8", "RGNSW9", 
"BH7D3P1", "W31S84", "NTHDJ4", "H3UA1", "AH9N7", 
"DF52B68", "K65C2", "VGT2Q0", "93LR6", "SJAJ0", 
"WQBH47", "CP8PW9", "5H2TD5", "TFLKV4", "X42J1" )

R中的查询/代码如下：

UKSQL6<-data.frame(sqlQuery(myConn, paste("SELECT TOP 10000 [AxiomaDate]
                      ,[RiskModelID] ,[AxiomaID],[Factor1],[Factor2],[Factor3],[Factor4],[Factor5]
                      ,[Factor6],[Factor7],[Factor8],[Factor9],[Factor10],[Factor11],[Factor12]
                      ,[Factor13],[Factor14],[Factor15]FROM [PortfolioAnalytics].[Data_Axioma].[SecurityExposures]
                      Where AxiomaDate IN (
                        SELECT   MAX(AxiomaDate)
                        FROM     [PortfolioAnalytics].[Data_Axioma].[FactorReturns]
                                  GROUP BY MONTH(AxiomaDate), YEAR(AxiomaDate))
                      AND RiskModelID = 8
                      AND  AxiomaID IN(",paste(UKWinnersID, collapse = ","),")")))

我将UKWinnersID粘贴在上面代码的最后一行中，但UKWinnersID的格式必须为（'1W167X6'，'QM6VY8'，'ZDNZX0'..等），并带有单引号，但我无法使用。

Answer 1

考虑使用RODBCext包（ RODBC的扩展名）运行参数化查询 ，假设这是所使用的API。 参数化查询的作用远不止于SQL注入，还可以从代码中提取数据，并且避免了混乱的引号括起来以及字符串的内插和连接，从而使代码更整洁，可维护。

下面针对20个ID分别将您的TOP 10000替换为TOP 500 ：

library(RODBC)
library(RODBCext)

conn <- odbcConnect("DBName", uid="user", pwd="password")

ids_df <- data.frame(UKWinnersID = c("1W167X6", "QM6VY8", "ZDNZX0", "8J49D8", "RGNSW9", 
                                    "BH7D3P1", "W31S84", "NTHDJ4", "H3UA1", "AH9N7", 
                                    "DF52B68", "K65C2", "VGT2Q0", "93LR6", "SJAJ0", 
                                    "WQBH47", "CP8PW9", "5H2TD5", "TFLKV4", "X42J1"))

# SQL STATEMENT (NO DATA)
query <- "SELECT TOP 500 [AxiomaDate], [RiskModelID], [AxiomaID], [Factor1],[Factor2]
                 , [Factor3], [Factor4], [Factor5], [Factor6], [Factor7], [Factor8]
                 , [Factor9], [Factor10], [Factor11], [Factor12]
                 , [Factor13], [Factor14], [Factor15]
          FROM [PortfolioAnalytics].[Data_Axioma].[SecurityExposures]
          WHERE AxiomaDate IN (
                   SELECT   MAX(AxiomaDate)
                   FROM     [PortfolioAnalytics].[Data_Axioma].[FactorReturns]
                   GROUP BY MONTH(AxiomaDate), YEAR(AxiomaDate)
                )
            AND RiskModelID = 8
            AND AxiomaID = ?"

# PASS DATAFRAME VALUES TO BIND TO QUERY PARAMETERS
UKSQL6 <- sqlExecute(conn, query, ids_df, fetch=TRUE)

odbcClose(conn)

另外，如果您确实需要使用IN()子句：

# SQL STATEMENT (NO DATA)
query <- paste("SELECT TOP 10000 

                  ...same as above...

                  AND AxiomaID IN (", paste(rep("?", nrow(ids_df)), collapse=", "), ")")

# TRANSPOSE DATA FRAME FOR COLUMN EQUAL TO ? PLACEHOLDERS
UKSQL6 <- sqlExecute(conn, query, t(ids_df), fetch=TRUE)