sql - MSSQL stored procedure select all columns -
i have stored procedure select statement looks this:
select @keyname dbo.ficonfig (nolock) issuerkey = @issuerkey where i'm creating this:
create procedure get_ficonfig @issuerkey int, @keyname nvarchar(100) where keyname column name retrieving data from.
my question: possible pass in * select columns although procedure asking specific column name?
edit: unfortunately think may have worded question poorly. looking way see if stored procedure tell if wanted select records table, or specific columns record. i've solved own problem using null checks , if/else statements.
you can use dynamic query:
create procedure get_ficonfig @issuerkey int, @keyname nvarchar(100) declare @s varchar(500) = 'select ' + @keyname + ' dbo.ficonfig (nolock) issuerkey = ' + cast(@issuerkey varchar(10)) exec(@s) you should careful here. possible sql injection. can not pass column names parameters dynamic query, there no other way.
but can select information_schema.columns table sure valid column name passed:
if exists(select * information_schema.columns table_name = 'ficonfig' , column_name = @keyname) begin declare @s varchar(500) = 'select ' + @keyname + ' dbo.ficonfig (nolock) issuerkey = ' + cast(@issuerkey varchar(10)) exec(@s) end else throw... edit:
as user @lamak said better use quotename function. automatically add brackets around value of variable:
create procedure get_ficonfig @issuerkey int, @keyname nvarchar(100) declare @s varchar(500) = 'select ' + quotename(@keyname) + ' dbo.ficonfig (nolock) issuerkey = ' + cast(@issuerkey varchar(10)) exec(@s)
Comments
Post a Comment