は動的ストアドプロシージャにWHERE句にパラメータを渡す方法を

Question

ALTER PROCEDURE [dbo].[GetCustomers_PagerSelected] 
    @PageIndex INT, 
    @PageSize INT = 10, 
    @SubCondition nvarchar(max), 
    @RecordCount INT OUTPUT 
AS 
BEGIN 
    SET NOCOUNT ON; 

    SELECT 
     ROW_NUMBER() OVER (ORDER BY [Plan_Id] ASC) AS RowNumber, 
     [Plan_Id], [User_Id], [Plan_Name], 
     [ImageCount], [PlanPrice], 
     '../User/HomePlanImage/' + CONVERT(varchar(5), User_Id) +'/' + CONVERT(varchar(5), Plan_Id) + '/' + CONVERT(varchar(5),1) +'.jpg' AS PlanImagePath 
    INTO 
     #Results 
    FROM 
     [mf_BuildingPlanDetails] 
    WHERE 
     IsActive = 1 @SubCondition 

    SELECT 
     @RecordCount = COUNT(*) 
    FROM 
     #Results 

    SELECT * 
    FROM #Results 
    WHERE 
     RowNumber BETWEEN(@PageIndex -1) * @PageSize + 1 AND(((@PageIndex -1) * @PageSize + 1) + @PageSize) - 1 

    DROP TABLE #Results 

Answer 1

このような何かはおそらく、あなたが欲しいものを行う必要があります。

ALTER PROCEDURE [dbo].[GetCustomers_PagerSelected] 
    @PageIndex INT, 
    @PageSize INT = 10, 
    @SubCondition nvarchar(max), 
    @RecordCount INT OUTPUT 
AS 
BEGIN 
    SET NOCOUNT ON; 

    DECLARE @Sql varchar(max) 

    CREATE TABLE #Results 
    (
     RowNumber int, 
     Plan_Id int, -- Guessing the column data type, change if needed 
     User_Id int, -- Guessing the column data type, change if needed 
     Plan_Name varchar(200), -- Guessing the column data type and lengthe, change if needed 
     ImageCount int, -- Guessing the column data type, change if needed 
     PlanPrice money, -- Guessing the column data type, change if needed 
     PlanImagePath varchar(300), -- Guessing the column data type and lengthe, change if needed 
    ) 

    SET @Sql = ' 
    SELECT 
     ROW_NUMBER() OVER (ORDER BY [Plan_Id] ASC) AS RowNumber, 
     [Plan_Id], 
     [User_Id], 
     [Plan_Name], 
     [ImageCount], 
     [PlanPrice], 
     ''../User/HomePlanImage/'' + CONVERT(varchar(5), User_Id) + 
           ''/'' + CONVERT(varchar(5), Plan_Id) + 
           ''/'' + CONVERT(varchar(5),1) + 
           ''.jpg'' AS PlanImagePath 

    FROM 
     [mf_BuildingPlanDetails] 
    WHERE 
     IsActive = 1 ' + @SubCondition 

    INSERT INTO #Results 
    EXEC sp_executeSql @Sql 

    SELECT 
     @RecordCount = COUNT(*) 
    FROM 
     #Results 

    SELECT * 
    FROM #Results 
    WHERE 
     RowNumber BETWEEN(@PageIndex -1) * @PageSize + 1 AND(((@PageIndex -1) * @PageSize + 1) + @PageSize) - 1 

    DROP TABLE #Results 
END 

しかし、クエリを使用すると、これがあるように注意してくださいセキュリティの危険SQL injectionの攻撃に対して脆弱です。 私は強く別の方法をお勧めしますが、十分な情報がないため、アドバイスできません。