Can you send a WHERE clause from access to Microsoft SQL server

I have a screen in access where I am allowing the user to choose what they do and do not want selected from a query. I am building the WHERE clause dynamically based off of what they select. This query takes way to long to run in access, but only takes about eight seconds in Microsoft SQL server. I have created a stored procedure in SQL server and I want to pass the WHERE clause that I have built into it, but it wants the variable to be set equal to something instead of just the statement in order to prevent SQL injection attacks. I have also tried to use exec() and pass everything as a string, but i have strings in my WHERE clause which prevent the entire string from passing. ex. 'This is a example ' strVar ' that I pass'. Is there any way I can pass the information I want into SQL server?

Thanks
Brandon GarnettAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

PatHartmanCommented:
You have to build the query in VBA so that all the variables can be expanded first.

strSQL = "Select ...., From ... WHERE ClientID = " & Me.ClientID & " AND " OrderDate > #" & Me.FromDate & "#;"
0
Brandon GarnettAuthor Commented:
On my form I just have radio buttons, two for each choice, once to include that item, one to not include that item. I do not know what they will choose or if they will choose it. When they select something I simply add it to the WHERE clause.

WhereClause = WhereClause + "tblProject.ProjectStatus = 2"

I then just pass WhereClause into SQL server where it will hopefully run it.
Would I have to create a variable for each item on the page and pass it to SQL server?
0
PatHartmanCommented:
You need to create the ENTIRE SQL string.  So, create a variable that includes the static part and then concatenate the variable part to make a complete string.  Save the string as a pass-through querydef.  Replace the Form's RecordSource with the name of the new pass-through query.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

John_VidmarCommented:
I too would build the query in VBA:
strSQL = "SELECT ... FROM ... WHERE ..."

if boolean-expression-based-on-what-user-selected then
	strSQL = strSQL + " AND somefield = whatever"
end if

if another-boolean-expression-based-on-a-different-user-selection then
	strSQL = strSQL + " AND someotherfield = somethingelse"
end if

Open in new window

If you are selecting from one table, and there is no initial WHERE-clause then I do this:
strSQL = "SELECT ... FROM ... WHERE 1=1 "

if boolean-expression-based-on-what-user-selected then
	strSQL = strSQL + " AND somefield = whatever"
end if

if another-boolean-expression-based-on-a-different-user-selection then
	strSQL = strSQL + " AND someotherfield = somethingelse"
end if

Open in new window

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Brandon GarnettAuthor Commented:
I was able to pass just my WHERE clause into SQL server by creating a variable in SQL server:

@SQL = 'SELECT .... FROM ... WHERE ' + @WhereClause
exec(@SQL)

But building the query in VBA and running the query as exec(@VBA) would work as well.
0
Jim HornMicrosoft SQL Server Developer, Architect, and AuthorCommented:
Looks like we have a winner here, but in case it helps I have an article called Migrating your Access Queries to SQL Server Transact-SQL that is a big honkin' comparison between Access and SQL Server T-SQL.  If it helps please click the big green 'Was this article helpful?' button at the end.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft SQL Server

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.