2015-10-02 73 views
0

我正在編寫此存儲過程,但不斷收到錯誤。存儲過程中的字符串長

我的方法:

USE AllCtuStudentInfo 
GO 

SET ANSI_NULLS ON 
GO 
SET QUOTED_IDENTIFIER ON 
GO 

CREATE PROCEDURE SelectProcedure4 

    @myVar VARCHAR(8000), 
    @Schema varchar(50), 
    @ID int 
    [email protected] INT = 1 


AS 
--WHILE @ix < 1000 
BEGIN 
    set @myVar = 'SELECT '[email protected]+'.Student.Name, '[email protected]+'.Student.Surname, '[email protected]+'.Course.Name AS Course,'[email protected]+'.LearningUnit.Name AS [Learning Unit], '[email protected]+'.Formative.[Formative Name], '[email protected]+'.FormativeMark.Mark, '[email protected]+'.Summative.[Summative Name], '[email protected]+'.SummativeMark.Mark AS Mark FROM '[email protected]+'.LearningUnit INNER JOIN '[email protected]+'.Formative INNER JOIN '[email protected]+'.Course INNER JOIN '[email protected]+'.SummativeMark INNER JOIN '[email protected]+'.FormativeMark INNER JOIN '[email protected]+'.Student ON '[email protected]+'.FormativeMark.FK_Student = '[email protected]+'.Student.ID ON '[email protected]+'.SummativeMark.FK_Student = '[email protected]+'.Student.ID ON '[email protected]+'.Course.ID = '[email protected]+'.Student.FK_Course INNER JOIN '[email protected]+'.Summative ON '[email protected]+'.SummativeMark.FK_Summative = '[email protected]+'.Summative.ID ON '[email protected]+'.Formative.ID = '[email protected]+'.FormativeMark.FK_Formative ON '[email protected]+'.LearningUnit.ID = '[email protected]+'.Summative.FK_LU AND '[email protected]+'.LearningUnit.ID = '[email protected]+'.Formative.FK_LU WHERE '[email protected]+'.Student.ID = '''+CAST(@ID AS VARCHAR(10))+''';' 
    --SET @ix = @ix + 1 
    EXEC @myVar 
END 

我如何執行它:

USE AllCtuStudentInfo 

EXEC SelectProcedure4 @myVar = '', @Schema = 'Auckland_Park', @ID = 1 

錯誤:

Msg 203, Level 16, State 2, Procedure SelectProcedure4, Line 15

The name 'SELECT Auckland_Park.Student.Name, Auckland_Park.Student.Surname, Auckland_Park.Course.Name AS Course,Auckland_Park.LearningUnit.Name AS [Learning Unit], Auckland_Park.Formative.[Formative Name], Auckland_Park.FormativeMark.Mark, Auckland_Park.Summative.[Summative Name], Auckland_Park.SummativeMark.Mark AS Mark FROM Auckland_Park.LearningUnit INNER JOIN Auckland_Park.Formative INNER JOIN Auckland_Park.Course INNER JOIN Auckland_Park.SummativeMark INNER JOIN Auckland_Park.FormativeMark INNER JOIN Auckland_Park.Student ON Auckland_Park.FormativeMark.FK_Student = Auckland_Park.Student.ID ON Auckland_Park.SummativeMark.FK_Student = Auckland' is not a valid identifier.

正如你可以看到它被切斷。我嘗試了其他一些方法,但我總是以相同的錯誤結束,並在同一個地方被截斷。

請幫忙!

+0

嘗試'EXEC(SelectProcedure4 '', 'Auckland_Park',1)' – wiretext

+1

的*錯誤信息*被截斷,而不是基本的字符串(選擇@myvar是正確的) - 如說你需要調用exec (@myVar)帶圓括號。 –

+0

如果沒有括號,'EXEC'假定你正在執行一個存儲過程,而不是查詢; SQL Server認爲查詢是一個proc名稱。我建議你使用sp_executesql而不是EXEC,並參數化查詢。 –

回答

3

下面是一個使用sp_executesql和參數化查詢的示例。

CREATE PROCEDURE dbo.SelectProcedure4 

    @myVar nvarchar(MAX), 
    @Schema sysname, 
    @ID int 
AS 
DECLARE @SchemaName nvarchar(130) = QUOTENAME(@Schema); 

SET @myVar = 'SELECT '[email protected]+'.Student.Name, '[email protected]+'.Student.Surname, '[email protected]+'.Course.Name AS Course,'[email protected]+'.LearningUnit.Name AS [Learning Unit], '[email protected]+'.Formative.[Formative Name], '[email protected]+'.FormativeMark.Mark, '[email protected]+'.Summative.[Summative Name], '[email protected]+'.SummativeMark.Mark AS Mark FROM '[email protected]+'.LearningUnit INNER JOIN '[email protected]+'.Formative INNER JOIN '[email protected]+'.Course INNER JOIN '[email protected]+'.SummativeMark INNER JOIN '[email protected]+'.FormativeMark INNER JOIN '[email protected]+'.Student ON '[email protected]+'.FormativeMark.FK_Student = '[email protected]+'.Student.ID ON '[email protected]+'.SummativeMark.FK_Student = '[email protected]+'.Student.ID ON '[email protected]+'.Course.ID = '[email protected]+'.Student.FK_Course INNER JOIN '[email protected]+'.Summative ON '[email protected]+'.SummativeMark.FK_Summative = '[email protected]+'.Summative.ID ON '[email protected]+'.Formative.ID = '[email protected]+'.FormativeMark.FK_Formative ON '[email protected]+'.LearningUnit.ID = '[email protected]+'.Summative.FK_LU AND '[email protected]+'.LearningUnit.ID = '[email protected]+'.Formative.FK_LU WHERE '[email protected]+'.Student.ID = @ID;' 

EXECUTE sp_executesql @myVar, N'@ID int', @ID= @ID; 
GO 
+0

更好的選擇,在這裏。 –

+1

我所做的唯一更改就是將SchemaName包裝在QUOTENAME中以幫助防止sql注入。由於它是sysname,所以它的長度相當短,但你仍然可以在一個簡短的字符串中做一些非常討厭的東西。 –

+0

@SeanLange,腳本中的SchemaName是QUOTENAME從原始參數返回的值。這不是解決SQL注入問題嗎? –