在动态 SQL 中使用变量

Question

ALTER PROCEDURE [dbo].[Create_Subjects]
    @Subj_ID nvarchar(9)
AS
    DECLARE @First3Digits nvarchar(3);
    DECLARE @Result int;

    -- Fetching the first 3 digits of the subject
    SET @First3Digits = SUBSTRING(@Subj_ID,1,3);

    -- Check if view is present or not
    IF EXISTS (SELECT 1 FROM sys.views WHERE Name = @First3Digits)
    BEGIN
        PRINT 'View exists'
        -- checking if the subject is present in the view
        IF EXISTS (SELECT 1 FROM @First3Digits WHERE SubjectName = @Subj_ID)
        BEGIN
            SET @Result = 1;
        END
        ELSE
        BEGIN
            SET @Result = 0;
        END
    END
    ELSE
    BEGIN
        -- Create a view as view doesn't exist
        EXEC('create view' + @First3Digits 
            + 'as 
                    (select SubjectName from dbo.Subjects where SubjectName like '+@First3Digits+'%'+');')

        SET @Result = 0;
        PRINT 'view does not exist'
    END

    PRINT @First3Digits
GO;

在上面的代码中，我遇到了问题

IF EXISTS (SELECT 1 FROM @First3Digits WHERE SubjectName = @Subj_ID) 

请帮我解决这个问题。

Answer 1

行：

IF EXISTS (SELECT 1 FROM @First3Digits WHERE SubjectName = @Subj_ID)

因为@First3Digits 是表的名称而损坏（我假设-即使它只有nvarchar(3)！）并且不能直接在这样的查询中使用，而是您需要使用动态SQL，特别是@987654321 @如下：

PRINT 'View exists'

declare @Sql nvarchar(max);

set @Sql = 'select @Result = case when exists (select 1 from dbo.' + quotename(@First3Digits) + ' where SubjectName = ''' + @Subj_ID + ''') then 1 else 0 end';

execute sp_executesql @Sql, N'@Result bit out', @Result = @Result out; 

-- @Result is now set as required

注意使用quotename 来防止SQL 注入。

顺便说一句，从表面上看，您的设计看起来非常需要改进。根据Subject（无论实际是什么）创建一个视图似乎存在缺陷，容易出现维护问题和可伸缩性问题。可能有更好的方法。