【问题标题】:String to long in stored procedure存储过程中长字符串
【发布时间】:2015-12-30 15:21:24
【问题描述】:

我正在编写此存储过程,但不断出错。

我的程序:

USE AllCtuStudentInfo
GO

SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO

CREATE PROCEDURE SelectProcedure4

    @myVar VARCHAR(8000),
    @Schema varchar(50),
    @ID int
    --@ix INT = 1


AS
--WHILE @ix < 1000
BEGIN
    set @myVar = 'SELECT '+@Schema+'.Student.Name, '+@Schema+'.Student.Surname, '+@Schema+'.Course.Name AS Course,'+@Schema+'.LearningUnit.Name AS [Learning Unit], '+@Schema+'.Formative.[Formative Name], '+@Schema+'.FormativeMark.Mark, '+@Schema+'.Summative.[Summative Name], '+@Schema+'.SummativeMark.Mark AS Mark FROM '+@Schema+'.LearningUnit INNER JOIN '+@Schema+'.Formative INNER JOIN '+@Schema+'.Course INNER JOIN '+@Schema+'.SummativeMark INNER JOIN '+@Schema+'.FormativeMark INNER JOIN '+@Schema+'.Student ON '+@Schema+'.FormativeMark.FK_Student = '+@Schema+'.Student.ID ON '+@Schema+'.SummativeMark.FK_Student = '+@Schema+'.Student.ID ON  '+@Schema+'.Course.ID = '+@Schema+'.Student.FK_Course  INNER JOIN '+@Schema+'.Summative ON '+@Schema+'.SummativeMark.FK_Summative = '+@Schema+'.Summative.ID ON '+@Schema+'.Formative.ID = '+@Schema+'.FormativeMark.FK_Formative ON  '+@Schema+'.LearningUnit.ID = '+@Schema+'.Summative.FK_LU AND '+@Schema+'.LearningUnit.ID = '+@Schema+'.Formative.FK_LU WHERE '+@Schema+'.Student.ID = '''+CAST(@ID AS VARCHAR(10))+''';'
    --SET @ix = @ix + 1
    EXEC @myVar
END

我如何执行它:

USE AllCtuStudentInfo

EXEC SelectProcedure4 @myVar = '',  @Schema = 'Auckland_Park', @ID = 1

错误:

消息 203,级别 16,状态 2,过程 SelectProcedure4,第 15 行

名称 'SELECT Auckland_Park.Student.Name, Auckland_Park.Student.Surname,Auckland_Park.Course.Name AS Course,Auckland_Park.LearningUnit.Name AS [学习单元], Auckland_Park.Formative.[Formative Name], Auckland_Park.FormativeMark.Mark,Auckland_Park.Summative.[Summative 名称],Auckland_Park.SummativeMark.Mark AS Mark FROM Auckland_Park.LearningUnit INNER JOIN Auckland_Park.Formative INNER 加入奥克兰_Park.Course INNER 加入奥克兰_Park.SummativeMark INNER 加入 Auckland_Park.FormativeMark INNER 加入 Auckland_Park.Student ON Auckland_Park.FormativeMark.FK_Student = Auckland_Park.Student.ID ON Auckland_Park.SummativeMark.FK_Student = Auckland' 无效 标识符。

如您所见,它被切断了。我尝试了其他一些方法,但我总是以同样的错误告终,并且它在同一个地方被切断。

请帮忙!

【问题讨论】:

  • 试试exec (SelectProcedure4 '','Auckland_Park',1)
  • 错误消息被截断,而不是基础字符串(选择 @myvar 是正确的)-正如所说,您需要使用括号调用 EXEC (@myVar)。跨度>
  • 没有括号,EXEC 假定您正在执行存储过程,而不是查询; SQL Server 认为查询是一个过程名称。我建议你使用 sp_executesql 而不是 EXEC,并参数化查询。

标签: sql sql-server stored-procedures


【解决方案1】:

以下是使用 sp_executesql 和参数化查询的示例。

CREATE PROCEDURE dbo.SelectProcedure4

    @myVar nvarchar(MAX),
    @Schema sysname,
    @ID int
AS
DECLARE @SchemaName nvarchar(130) = QUOTENAME(@Schema);

SET @myVar = 'SELECT '+@SchemaName+'.Student.Name, '+@SchemaName+'.Student.Surname, '+@SchemaName+'.Course.Name AS Course,'+@SchemaName+'.LearningUnit.Name AS [Learning Unit], '+@SchemaName+'.Formative.[Formative Name], '+@SchemaName+'.FormativeMark.Mark, '+@SchemaName+'.Summative.[Summative Name], '+@SchemaName+'.SummativeMark.Mark AS Mark FROM '+@SchemaName+'.LearningUnit INNER JOIN '+@SchemaName+'.Formative INNER JOIN '+@SchemaName+'.Course INNER JOIN '+@SchemaName+'.SummativeMark INNER JOIN '+@SchemaName+'.FormativeMark INNER JOIN '+@SchemaName+'.Student ON '+@SchemaName+'.FormativeMark.FK_Student = '+@SchemaName+'.Student.ID ON '+@SchemaName+'.SummativeMark.FK_Student = '+@SchemaName+'.Student.ID ON  '+@SchemaName+'.Course.ID = '+@SchemaName+'.Student.FK_Course  INNER JOIN '+@SchemaName+'.Summative ON '+@SchemaName+'.SummativeMark.FK_Summative = '+@SchemaName+'.Summative.ID ON '+@SchemaName+'.Formative.ID = '+@SchemaName+'.FormativeMark.FK_Formative ON  '+@SchemaName+'.LearningUnit.ID = '+@SchemaName+'.Summative.FK_LU AND '+@SchemaName+'.LearningUnit.ID = '+@SchemaName+'.Formative.FK_LU WHERE '+@SchemaName+'.Student.ID = @ID;'

EXECUTE sp_executesql @myVar, N'@ID int', @ID= @ID;
GO

【讨论】:

  • 我要做的唯一更改是将 SchemaName 包装在 QUOTENAME 中以帮助防止 sql 注入。由于它是 sysname,因此长度相当短,但您仍然可以在短字符串中做一些非常讨厌的事情。
  • @SeanLange,脚本中的SchemaName是QUOTENAME从原始参数返回的值。这不是解决 SQL 注入问题吗?
  • @DanGuzman 是的。当我最初阅读它时,我错过了。即便如此,您已经获得了我的 +1。 :)
猜你喜欢
  • 2016-07-28
  • 1970-01-01
  • 2013-10-13
  • 1970-01-01
  • 1970-01-01
  • 2017-02-27
  • 1970-01-01
  • 2017-06-05
  • 2016-05-07
相关资源
最近更新 更多