SQL SERVER 2008动态查询问题

Question

我有这样的动态查询

Alter PROCEDURE dbo.mySP 
    -- Add the parameters for the stored procedure here
    (
        @DBName varchar(50),
        @tblName varchar(50)

    )

AS
BEGIN
-- SET NOCOUNT ON added to prevent extra result sets from
-- interfering with SELECT statements.
SET NOCOUNT ON;

-- Insert statements for procedure here
declare @string as varchar(50)
declare @string1 as varchar(50)

set @string1  = '[' + @DBName + ']' + '.[dbo].' + '[' + @tblName + ']'

set @string = 'select * from ' + @string1   

exec @string

结束

我这样打

dbo.mySP 'dbtest1','tblTest'

我遇到一个错误

"Msg 203, Level 16, State 2, Procedure mySP, Line 27
The name 'select * from [dbtest1].[dbo].[tblTest]' is not a valid identifier."

怎么了？ 以及如何克服？

提前致谢

Answer 1

它认为@string的内容引用存储过程名称。 你需要放

EXEC (@string)

或更好地使用存储过程sp_executesql

您还应该设置一些保护代码，以检查所传递的值是真实表和数据库的名称。 您可以在INFORMATION_SCHEMA中查询视图以验证输入。

您可以在我的博客上阅读有关更安全的动态SQL的更多信息。

Answer 2

更改

exec @string

至

exec(@string)

这是我刚刚测试过的有效SP：

CREATE PROCEDURE [dbo].[test] 
    @DBName varchar(50),
    @tblName varchar(50)
AS
BEGIN
    SET NOCOUNT ON;

    DECLARE @string AS VARCHAR(50)
    DECLARE @string1 AS VARCHAR(50)

    SET @string1 = '[' + @DBName + '].[dbo].[' + @tblName + ']'
    SET @string = 'select * from ' + @string1

    EXEC(@string)
END

Answer 3

如果将EXEC用作：

EXEC @String

它正在尝试使用@String变量中包含的名称运行过程。 试试看：

create procedure TestProc
as
print 'you called TestProc!'
go

declare @string varchar(20)
set @string='TestProc'

exec @string

如果将EXEC用作：

EXEC (@Query)

您在@Query变量中运行sql，请尝试一下：

DECLARE @Query  varchar(50)
set @Query='Print ''just ran it!'''

EXEC (@Query)

Answer 4

ALTER PROCEDURE test_sp
    -- Add the parameters for the stored procedure here
    (
        @DBName varchar(50),
        @tblName varchar(50)

    )

AS
BEGIN
-- SET NOCOUNT ON added to prevent extra result sets from
-- interfering with SELECT statements.
SET NOCOUNT ON

-- Insert statements for procedure here
declare @string as varchar(100)
declare @string1 as varchar(50)

set @string1  = '[' + @DBName + ']' + '.[dbo].' + '[' + @tblName + ']'
Print @string1
set @string = 'select * from'  + @string1       
Print @string
exec (@string)
SET NOCOUNT OFF  
END