參數化一個簡單的SQL更新查詢

Question

我有以下代碼作爲SQL中的存儲過程，但它不接受@DBNAME，聲明它需要聲明，但我已經聲明瞭它。

SET ANSI_NULLS ON 
GO 
SET QUOTED_IDENTIFIER ON 
GO 

CREATE PROCEDURE UpdateSQL 
-- Add the parameters for the stored procedure here 
@UpdateField varchar(25), 
@UpdateValue varchar(25), 
@FilterField varchar(25), 
@FilterValue varchar(25), 
@DBNAME sysname 

AS 
BEGIN 
-- SET NOCOUNT ON added to prevent extra result sets from 
-- interfering with SELECT statements. 
SET NOCOUNT ON; 

-- Insert statements for procedure here 
UPDATE @DBNAME SET @UpdateField = @UpdateValue WHERE @FilterField = @FilterValue 
END 
GO 

下面是一個C＃函數調用SQL過程：

internal static bool UpdateSql(SqlArgs pSqlArgs) 
{ 
    var pwd = GetPwd(); 
    var sqlCred = new SqlCredential(Sqluser, pwd); 

    var tCatalog = GetDbo(pSqlArgs.PCatalog); 

    var sqlConnection = new SqlConnection 
    { 
     ConnectionString = $"Data Source={SqlServer};Initial Catalog={tCatalog};", 
     Credential = sqlCred 
    }; 

    var sqlCommand = new SqlCommand 
    { 
     Connection = sqlConnection, 
     CommandText = "UpdateSQL", 
     Parameters = { new SqlParameter("@DB", pSqlArgs.PDbo), new SqlParameter("@UpdateField", pSqlArgs.PUpdateField), 
      new SqlParameter("@UpdateValue", pSqlArgs.PUpdateValue), new SqlParameter("@FilterField", pSqlArgs.PFilterField), 
      new SqlParameter("@FilterValue", pSqlArgs.PFilterValue) }, 
      CommandType = CommandType.StoredProcedure, 
    }; 


    try 
    { 
     sqlConnection.Open(); 

     return sqlCommand.ExecuteNonQuery().Equals(1); 
    } 
    catch (SqlException ex) 
    { 
     MessageBox.Show($@"Error: {ex.Message}", @"Error", MessageBoxButtons.OK, MessageBoxIcon.Exclamation); 
     return false; 
    } 
    finally 
    { 
     sqlConnection.Close(); 
    } 
} 

我試圖運行的最終功能是：用@Database UPDATE @Table SET @UpdateField = @UpdateValue WHERE @ FilterField = @FilterValue

Answer 1

你需要使用動態SQL，因爲你不能指定表或列名在查詢參數：

CREATE PROCEDURE UpdateSQL 
-- Add the parameters for the stored procedure here 
    @UpdateField varchar(25), 
    @UpdateValue varchar(25), 
    @FilterField varchar(25), 
    @FilterValue varchar(25), 
    @DBNAME sysname 
AS 
BEGIN 
-- SET NOCOUNT ON added to prevent extra result sets from 
-- interfering with SELECT statements. 
    SET NOCOUNT ON; 

    DECLARE @sql NVARCHAR(MAX); 

    SET @sql = ' 
UPDATE @DBNAME SET @UpdateField = @UpdateValue WHERE @FilterField = @FilterValue 
'; 
    SET @sql = REPLACE(@sql, '@DBNAME', @DBNAME); 
    SET @sql = REPLACE(@sql, '@UpdateField', @UpdateField); 
    SET @sql = REPLACE(@sql, '@FilterField', @FilterField); 

    exec sp_executesql @sql, 
         N'@UpdateField varchar(25), @FilterField varchar(25)', 
         @UpdateField=@UpdateField, @FilterField=@FilterField; 
END; 

GO

Answer 2

您的代碼將@DBNAME聲明爲sysname，但update語句需要一個表。

我想你可能想看看這篇文章：how to set table name in dynamic sql query?

此外，關於同樣的問題這篇文章的會談：How should I pass a table name into a stored proc?