?
Solved

SQL Server - passing a string paramether to a Stored Proc

Posted on 2009-07-11
3
Medium Priority
?
301 Views
Last Modified: 2012-05-07
I pass a string as a parameter to a stored procedure that should get results but does not..  My SP looks like this

ALTER PROCEDURE [dbo].[spMySP]
      
@items nvarchar(50)
      
AS

SELECT    dayofWeek, anotherItem
  FROM table1

where cast(month(dayofWeek) as nvarchar(20)) in (@items)

END

I get no results regardless of what I pass as a parameter.  For example if i pass '1,2,3' as a parameter, i get nothing.  What the heck have i done wrong?
0
Comment
Question by:BoggyBayouBoy
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 60

Assisted Solution

by:chapmandew
chapmandew earned 600 total points
ID: 24830332
you'll need to do something like this....since it is a list of values, you'll need to use dynamic sql.  you can also use a function to split the values into a table...i'll show you the easier of the two:

declare @x nvarchar(2000)
set @x = 'SELECT    dayofWeek, anotherItem
  FROM table1 where cast(month(dayofWeek) as nvarchar(20)) in (' + @items + ')'

execute sp_executesql @x
0
 
LVL 29

Accepted Solution

by:
Göran Andersson earned 1400 total points
ID: 24830489
The string that you are using in the in clause is not considered to be a list of value, but just a single string.

in( '1,2,3' ) is not the same as in( '1', '2', '3' )

You can split the string into values and put in a temporary table, then join against the table to get the result.

As parsing the string verifies it's contents, it keeps the procedure from being wide open for SQL injection attacks.

alter procedure spMySP
   @items nvarchar(50)
as
 
declare @t table(m int)
declare @pos int
 
while (len(@items) > 0) begin
   set @pos = charindex(',', @items)
   if (@pos = 0) set @pos = len(@items) + 1
   insert into @t values (cast(substring(@items, 0, @pos) as int))
   set @items = substring(@items, @pos + 1, 1000)
end
 
select t1.dayOfWeek, t1.anotheritem
from table1 t1
inner join @t t on month(t1.dayOfWeek) = t.m

Open in new window

0
 
LVL 1

Author Closing Comment

by:BoggyBayouBoy
ID: 31602413
Thanks !  Very nice solutions.
0

Featured Post

Quick Start: DOCKER

Sometimes you just need a Quick Start on a topic in order to begin using it.. this is just what you need to know to get up and running with Docker!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Composite queries are used to retrieve the results from joining multiple queries after applying any filters. UNION, INTERSECT, MINUS, and UNION ALL are some of the operators used to get certain desired results.​
It is possible to export the data of a SQL Table in SSMS and generate INSERT statements. It's neatly tucked away in the generate scripts option of a database.
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
In this video, Percona Solution Engineer Dimitri Vanoverbeke discusses why you want to use at least three nodes in a database cluster. To discuss how Percona Consulting can help with your design and architecture needs for your database and infras…

800 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question