SQL SERVER 2008动态查询问题

Question

我有一个动态查询其内容是这样

Alter PROCEDURE dbo.mySP 
    -- Add the parameters for the stored procedure here 
    (
     @DBName varchar(50), 
     @tblName varchar(50) 

    ) 

AS 
BEGIN 
-- SET NOCOUNT ON added to prevent extra result sets from 
-- interfering with SELECT statements. 
SET NOCOUNT ON; 

-- Insert statements for procedure here 
declare @string as varchar(50) 
declare @string1 as varchar(50) 

set @string1 = '[' + @DBName + ']' + '.[dbo].' + '[' + @tblName + ']' 

set @string = 'select * from ' + @string1 

exec @string 

END

我打电话这样

dbo.mySP 'dbtest1','tblTest' 

而且我遇到一个错误

"Msg 203, Level 16, State 2, Procedure mySP, Line 27 
The name 'select * from [dbtest1].[dbo].[tblTest]' is not a valid identifier." 

什么是wr翁？和如何克服？提前

感谢

Answer 1

它认为的@string内容请参阅存储过程名称。你需要把

EXEC (@string) 

或更好的使用存储过程sp_executesql

你也应该设置一些后卫代码来检查要传递的价值观是真正的表格和数据库的名称。您可以查询INFORMATION_SCHEMA中的视图以验证输入。

您可以在我的博客上阅读safer dynamic SQL的更多信息。

Answer 2

变化

exec @string 

要

exec(@string) 

这里有一个工作SP我只是测试：

CREATE PROCEDURE [dbo].[test] 
    @DBName varchar(50), 
    @tblName varchar(50) 
AS 
BEGIN 
    SET NOCOUNT ON; 

    DECLARE @string AS VARCHAR(50) 
    DECLARE @string1 AS VARCHAR(50) 

    SET @string1 = '[' + @DBName + '].[dbo].[' + @tblName + ']' 
    SET @string = 'select * from ' + @string1 

    EXEC(@string) 
END 

Answer 3

如果你使用EXEC为：

EXEC @String 

它试图运行与包含在@String变量中的名称的过程。尝试一下：

create procedure TestProc 
as 
print 'you called TestProc!' 
go 

declare @string varchar(20) 
set @string='TestProc' 

exec @string 

如果你使用EXEC为：

EXEC (@Query) 

运行@Query变量中的SQL语句，尝试一下：

DECLARE @Query varchar(50) 
set @Query='Print ''just ran it!''' 

EXEC (@Query) 

Answer 4

ALTER PROCEDURE test_sp 
    -- Add the parameters for the stored procedure here 
    (
     @DBName varchar(50), 
     @tblName varchar(50) 

    ) 

AS 
BEGIN 
-- SET NOCOUNT ON added to prevent extra result sets from 
-- interfering with SELECT statements. 
SET NOCOUNT ON 

-- Insert statements for procedure here 
declare @string as varchar(100) 
declare @string1 as varchar(50) 

set @string1 = '[' + @DBName + ']' + '.[dbo].' + '[' + @tblName + ']' 
Print @string1 
set @string = 'select * from' + @string1  
Print @string 
exec (@string) 
SET NOCOUNT OFF 
END