<small id='uMRdZ'></small><noframes id='uMRdZ'>

      1. <tfoot id='uMRdZ'></tfoot>

        <i id='uMRdZ'><tr id='uMRdZ'><dt id='uMRdZ'><q id='uMRdZ'><span id='uMRdZ'><b id='uMRdZ'><form id='uMRdZ'><ins id='uMRdZ'></ins><ul id='uMRdZ'></ul><sub id='uMRdZ'></sub></form><legend id='uMRdZ'></legend><bdo id='uMRdZ'><pre id='uMRdZ'><center id='uMRdZ'></center></pre></bdo></b><th id='uMRdZ'></th></span></q></dt></tr></i><div id='uMRdZ'><tfoot id='uMRdZ'></tfoot><dl id='uMRdZ'><fieldset id='uMRdZ'></fieldset></dl></div>

        • <bdo id='uMRdZ'></bdo><ul id='uMRdZ'></ul>
        <legend id='uMRdZ'><style id='uMRdZ'><dir id='uMRdZ'><q id='uMRdZ'></q></dir></style></legend>
      2. 如何创建可以选择搜索列的存储过程?

        How do I create a stored procedure that will optionally search columns?(如何创建可以选择搜索列的存储过程?)

        <small id='50Oqm'></small><noframes id='50Oqm'>

        <tfoot id='50Oqm'></tfoot>

              • <bdo id='50Oqm'></bdo><ul id='50Oqm'></ul>
              • <i id='50Oqm'><tr id='50Oqm'><dt id='50Oqm'><q id='50Oqm'><span id='50Oqm'><b id='50Oqm'><form id='50Oqm'><ins id='50Oqm'></ins><ul id='50Oqm'></ul><sub id='50Oqm'></sub></form><legend id='50Oqm'></legend><bdo id='50Oqm'><pre id='50Oqm'><center id='50Oqm'></center></pre></bdo></b><th id='50Oqm'></th></span></q></dt></tr></i><div id='50Oqm'><tfoot id='50Oqm'></tfoot><dl id='50Oqm'><fieldset id='50Oqm'></fieldset></dl></div>

                    <tbody id='50Oqm'></tbody>

                  <legend id='50Oqm'><style id='50Oqm'><dir id='50Oqm'><q id='50Oqm'></q></dir></style></legend>

                  本文介绍了如何创建可以选择搜索列的存储过程?的处理方法,对大家解决问题具有一定的参考价值,需要的朋友们下面随着跟版网的小编来一起学习吧!

                  问题描述

                  我正在开发一个工作应用程序,它将查询我们的员工数据库.最终用户希望能够根据标准姓名/部门条件进行搜索,但他们还希望能够灵活地查询在卫生部门工作、名字为James"的所有人员.我想避免的一件事是简单地让存储过程获取参数列表并生成要执行的 SQL 语句,因为这会在内部级别打开 SQL 注入的大门.

                  I'm working on an application for work that is going to query our employee database. The end users want the ability to search based on the standard name/department criteria, but they also want the flexibility to query for all people with the first name of "James" that works in the Health Department. The one thing I want to avoid is to simply have the stored procedure take a list of parameters and generate a SQL statement to execute, since that would open doors to SQL injection at an internal level.

                  这能做到吗?

                  推荐答案

                  虽然 COALESCE 技巧很巧妙,但我更喜欢的方法是:

                  While the COALESCE trick is neat, my preferred method is:

                  CREATE PROCEDURE ps_Customers_SELECT_NameCityCountry
                      @Cus_Name varchar(30) = NULL
                      ,@Cus_City varchar(30) = NULL
                      ,@Cus_Country varchar(30) = NULL
                      ,@Dept_ID int = NULL
                      ,@Dept_ID_partial varchar(10) = NULL
                  AS
                  SELECT Cus_Name
                         ,Cus_City
                         ,Cus_Country
                         ,Dept_ID
                  FROM Customers
                  WHERE (@Cus_Name IS NULL OR Cus_Name LIKE '%' + @Cus_Name + '%')
                        AND (@Cus_City IS NULL OR Cus_City LIKE '%' + @Cus_City + '%')
                        AND (@Cus_Country IS NULL OR Cus_Country LIKE '%' + @Cus_Country + '%')
                        AND (@Dept_ID IS NULL OR Dept_ID = @DeptID)
                        AND (@Dept_ID_partial IS NULL OR CONVERT(varchar, Dept_ID) LIKE '%' + @Dept_ID_partial + '%')
                  

                  这些类型的 SP 可以很容易地生成代码(并为表更改重新生成).

                  These kind of SPs can easily be code generated (and re-generated for table-changes).

                  您有几个处理数字的选项 - 取决于您想要精确语义还是搜索语义.

                  You have a few options for handling numbers - depending if you want exact semantics or search semantics.

                  这篇关于如何创建可以选择搜索列的存储过程?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持跟版网!

                  本站部分内容来源互联网,如果有图片或者内容侵犯了您的权益,请联系我们,我们会在确认后第一时间进行删除!

                  相关文档推荐

                  Maximum stored procedure, function, trigger, or view nesting level exceeded (limit 32)(超出最大存储过程、函数、触发器或视图嵌套级别(限制 32))
                  How to View Oracle Stored Procedure using SQLPlus?(如何使用 SQLPlus 查看 Oracle 存储过程?)
                  How to debug stored procedure in VS 2015?(如何在 VS 2015 中调试存储过程?)
                  Set the variable result, from query(设置变量结果,来自查询)
                  What is dynamic SQL?(什么是动态 SQL?)
                  Mysql - How to quit/exit from stored procedure(Mysql - 如何退出/退出存储过程)

                        <bdo id='bTuJR'></bdo><ul id='bTuJR'></ul>
                        <i id='bTuJR'><tr id='bTuJR'><dt id='bTuJR'><q id='bTuJR'><span id='bTuJR'><b id='bTuJR'><form id='bTuJR'><ins id='bTuJR'></ins><ul id='bTuJR'></ul><sub id='bTuJR'></sub></form><legend id='bTuJR'></legend><bdo id='bTuJR'><pre id='bTuJR'><center id='bTuJR'></center></pre></bdo></b><th id='bTuJR'></th></span></q></dt></tr></i><div id='bTuJR'><tfoot id='bTuJR'></tfoot><dl id='bTuJR'><fieldset id='bTuJR'></fieldset></dl></div>

                            <tbody id='bTuJR'></tbody>
                        • <small id='bTuJR'></small><noframes id='bTuJR'>

                          <tfoot id='bTuJR'></tfoot>

                          1. <legend id='bTuJR'><style id='bTuJR'><dir id='bTuJR'><q id='bTuJR'></q></dir></style></legend>