[英]How to rectify this query in SQL Server 2005
我有一个查询,它是两个查询的并集,结果查询返回重复记录,我不想重复记录。 我尝试使用DISTINCT
但仍得到相同的结果,有人可以帮助我解决此查询吗?
我还想知道此查询对SQL注入是否安全...我将在下面粘贴我的查询:
ALTER PROCEDURE [dbo].[sp_GetTrashListWithSorting] --'6dbf9a01-c88f-414d-8dd9-696749258cef', '6dbf9a01-c88f-414d-8dd9-696749258cef','DateTime ASC','0','30'
(
@p_CreatedBy UNIQUEIDENTIFIER,
@p_ToReceipientID UNIQUEIDENTIFIER,
@p_SortExpression NVARCHAR(100),
@p_StartIndex INT,
@p_MaxRows INT
)
AS
SET NOCOUNT ON;
IF LEN(@p_SortExpression) = 0
SET @p_SortExpression ='DateTime DESC'
DECLARE @Sql NVARCHAR(4000)
SET @sql = 'SELECT ID, DateTime, Subject, CreatedBy, ToReceipientID, Status
FROM (SELECT ID,
DateTime,
Subject,
CreatedBy,
ToReceipientID,
Status,
ROW_NUMBER() OVER(ORDER BY '+ @p_SortExpression +') AS Indexing
FROM (SELECT ID,
DateTime,
Subject,
CreatedBy,
ToReceipientID,
SenderStatus AS Status
FROM ComposeMail
WHERE (CreatedBy = @p)
AND (SenderStatus = 7 OR SenderStatus = 8)
UNION
SELECT ID,
DateTime,
Subject,
CreatedBy,
ToReceipientID,
ReceiverStatus As Status
FROM ComposeMail
WHERE (ToReceipientID = @p1)
AND (ReceiverStatus = 7 OR ReceiverStatus = 8)) AS NewDataTable
) AS IndexTable
WHERE
Indexing > @p2 AND Indexing<= (@p2+@p3)'
DECLARE @paramDefinition NVARCHAR(500)
SET @paramDefinition = N'@p UNIQUEIDENTIFIER ,@p1 UNIQUEIDENTIFIER, @p2 INT, @p3 INT'
EXEC sp_executesql @sql, @paramDefinition,
@p = @p_CreatedBy,
@p1 = @p_ToReceipientID,
@p2 = @p_StartIndex ,
@p3 = @p_MaxRows
1)我将您的SQL重新编写为:
WITH trash_list AS (
SELECT cm.id,
cm.datetime,
cm.subject,
cm.createdby,
cm.toreceipientid,
cm.senderstatus AS Status
FROM COMPOSEMAIL cm
WHERE cm.createdBy = @p
AND cm.enderStatus IN(7, 8)
UNION
SELECT cm.id,
cm.datetime,
cm.subject,
cm.createdby,
cm.toreceipientid,
cm.receiverstatus AS Status
FROM COMPOSEMAIL cm
WHERE cm.toreceipientid = @p1
AND cm.receiverstatus IN (7, 8))
SELECT t.id,
t.datetime,
t.subject,
t.createdby,
t.toreceipientid,
t.status
FROM (SELECT tl.id,
tl.datetime,
tl.subject,
tl.createdby,
tl.toreceipientid,
tl.status,
ROW_NUMBER() OVER(ORDER BY '+ @p_SortExpression +') AS Indexing
FROM trash_list tl
GROUP BY tl.id,
tl.datetime,
tl.subject,
tl.createdby,
tl.toreceipientid,
tl.status) t
WHERE t.indexing BETWEEN @p2 AND (@p2+@p3)
...但是,如果仍然有重复项,请检查WITH子句中SELECT / UNION中的逻辑。
在将其转换为动态SQL之前,使其能够像普通SQL一样工作。
2)该查询对于注入攻击是不安全的,因为当用户可以提供文本时,您不会处理单引号:
IF LEN(@p_SortExpression)=0
SET @p_SortExpression ='DateTime DESC'
...应该:
IF LEN(@p_SortExpression)=0
SET @p_SortExpression ='DateTime DESC'
ELSE
SET @p_SortExpression = REPLACE(@p_SortExpression, '''', '''''')
您不需要查询和联合。 代替这2行(每个子查询一个)
WHERE (CreatedBy = @p)
WHERE (ToReceipientID = @p1)
做到这一点(在一个查询中)
WHERE CreatedBy IN (@p, @p1)
像这样:
SELECT
ID
, DateTime
, Subject
, CreatedBy
, ToReceipientID
, Status
FROM (
SELECT
ID
, DateTime
, Subject
, CreatedBy
, ToReceipientID
, SenderStatus AS Status
, ROW_NUMBER() OVER (ORDER BY ' + @p_SortExpression + ') AS Indexing
FROM ComposeMail
WHERE CreatedBy IN (@p, @p1)
AND (SenderStatus = 7
OR SenderStatus = 8)
) AS IndexTable
WHERE Indexing > @p2
AND Indexing <= (@p2 + @p3)
但是我不确定我是否理解您如何传递@p或@ p1的值
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.