有條件的SQL格式

Question

我想知道它是否可能，當然它一定是。我想基本上是有條件創建基於用戶輸入的（以及在這個例子中，我們將使用3個文本框中輸入）一個dymanic SQL語句：

var firstname = document.getElementById('firstname').value 
var middle = document.getElementById('middle').value 
var lastname = document.getElementById('lastname').value 
var SQL 

（如果所有3個字段填寫... ）

SQL = "SELECT * FROM TABLE WHERE [Firstname] = '" + firstname + "' AND [Middle] = '" + middle + "' AND [Lastname] = '" + lastname + "'" 

（如果3場2處填寫...）

SQL = "SELECT * FROM TABLE WHERE [Firstname] = '" + firstname + "' AND [Lastname] = '" + lastname + "'" 

有沒有更好的方式來這樣做呢？更短的東西？或者我將不得不評估每個字段中的文本，然後定義SQL？

只是想知道，但它從來沒有傷害要問。

周杰倫

Answer 1

類似的東西應該工作...

SQL = "SELECT * FROM TABLE WHERE 

    1 = 
    (
    case 
    when LEN('" + firstname + "') > 0 and LEN('" + lastname + "') > 0 and LEN('" + middle + "') > 0 then ([Firstname] = '" + firstname + "' AND [Lastname] = '" + lastname + "' AND [Middle] = '" + middle + "') 
    when LEN('" + firstname + "') = 0 and LEN('" + lastname + "') > 0 and LEN('" + middle + "') > 0 then ([Lastname] = '" + lastname + "' AND [Middle] = '" + middle + "') 
    ... 
    end 
) 

或者更好：

SQL = "SELECT * FROM TABLE WHERE 
(
    (LEN('" + firstname + "') > 0 AND [FirstName] = '" + firstname + "') 
OR 
    LEN('" + firstname + "') = 0 
) 
AND (same for secondName) 
AND (same for middle)" 

Answer 2

如果你能順利通過值作爲參數到查詢，然後

SQL = " SELECT * 
    FROM TABLE 
    WHERE (@firstName is null OR [FirstName] = @firstName) 
     AND (@middle is null OR [Middle] = @middle) 
      AND (@lastName is null OR [Lastname] = @lastName" 

這也會阻止查詢緩存被垃圾郵件攔截，因爲您只會將1個查詢計劃存儲在緩存中。

Answer 3

Please don't ever do this.參數化查詢are your friend.