通过单个参数传递多个值

Question

ALTER PROCEDURE Example
     (@BranchCode AS INT,
      @Department VARCHAR(8000),
      @DateFrom AS DATETIME,
      @DateTo AS DATETIME,
      @TransactionNumber AS NVARCHAR(30)
      -- @Delimiter char(1)
    )
AS
BEGIN
    SET NOCOUNT ON;

    DECLARE @Sql NVARCHAR(MAX)

    SET @Sql = 'Select 
                    Mast.Branch_code, Mast.purerq_id as purerq_id,
                    Max(Mast.purreq_date) as purreq_date, Max(Mast.Dept_code) as Dept_code, 
                    Max(Mast.purreq_desc) as purreq_desc,
                    Sum(Det.purreq_qty2) as purreq_qty2, 
                    Det.Item_Code, Max(Mast.purreq_docecNo) as DocNo,
                    Sum(IsNull(Det.purreq_qty1,0)) as purreq_qty1,
                    IsNull(Det.purerq_TranNo,'') as purerq_TranNo,
                    IsNull(Max(Mast.purerq_adduserid),'') as Adduserid,
                    Max(Det.ItemPacking_Code) as ItemPacking_Code
                From 
                    tbl_purreqMaster Mast, tbl_purreq_detail1 Det
                Where 
                    Mast.Branch_code = Det.Branch_code And 
                    Mast.purerq_id = Det.purerq_id And
                    Mast.purreq_date Between ' + @DateFrom + ' And ' + @DateTo + ' And 
                    Mast.Dept_code IN (' + REPLACE( @Department, '''','') + ')  
                    Mast.Branch_code = ' + CAST(@BranchCode AS VARCHAR)   + ' AND
                    Mast.purreq_docecNo =' + @TransactionNumber + ' 
                Group By 
                    Mast.Branch_code, Mast.purerq_id, Det.Item_Code, Det.purerq_TranNo'

    PRINT @Sql 
    --exec sp_executesql @Sql
END
GO


EXEC Example 1,'7,8','2017-10-01 00:00:00','2017-10-30 00:00:00','ALIA/PURQGEN/0000001'

此查询显示此错误

消息 241，级别 16，状态 1，过程示例，第 18 行
从字符串转换日期和/或时间时转换失败。

但是我尝试了替换和转换函数来解决这个问题，但我没有找到解决方案

Answer 1

我会使用@params 与sp_executesql 一起用于不需要连接到您执行的字符串的参数。我还建议对@Department 进行更多处理，以防止sql injection。

ALTER PROCEDURE Example
     (@BranchCode AS INT,
      @Department VARCHAR(8000),
      @DateFrom AS DATETIME,
      @DateTo AS DATETIME,
      @TransactionNumber AS NVARCHAR(30)
      -- @Delimiter char(1)
    )
AS
BEGIN
    SET NOCOUNT ON;

    DECLARE @Sql NVARCHAR(MAX), @Params nvarchar(8000);
    set @Params = '@BranchCode INT, @DateFrom DATETIME, @DateTo DATETIME, @TransactionNumber NVARCHAR(30)'

    SET @Sql = 'Select 
                    Mast.Branch_code, Mast.purerq_id as purerq_id,
                    Max(Mast.purreq_date) as purreq_date, Max(Mast.Dept_code) as Dept_code, 
                    Max(Mast.purreq_desc) as purreq_desc,
                    Sum(Det.purreq_qty2) as purreq_qty2, 
                    Det.Item_Code, Max(Mast.purreq_docecNo) as DocNo,
                    Sum(IsNull(Det.purreq_qty1,0)) as purreq_qty1,
                    IsNull(Det.purerq_TranNo,'') as purerq_TranNo,
                    IsNull(Max(Mast.purerq_adduserid),'') as Adduserid,
                    Max(Det.ItemPacking_Code) as ItemPacking_Code
                From tbl_purreqMaster Mast
                  inner join tbl_purreq_detail1 Det
                    on Mast.Branch_code = Det.Branch_code
                   and Mast.purerq_id = Det.purerq_id
                Where Mast.purreq_date Between @DateFrom and @DateTo
                  and Mast.Dept_code IN (' + REPLACE( @Department, '''','') + ')
                  and Mast.Branch_code = @BranchCode
                  and Mast.purreq_docecNo = @TransactionNumber
                Group By 
                    Mast.Branch_code, Mast.purerq_id, Det.Item_Code, Det.purerq_TranNo'

    PRINT @Sql 
    --exec sp_executesql @Sql, @Params, @BranchCode, @DateFrom, @DateTo, @TransactionNumber
END

---

SQL Server 2008 中的最佳方法是为@DepartmentId 使用表值参数：

• Table-Valued Parameters - msdn
• User-Defined Table Types - msdn
• SQL Server 2008 Table-Valued Parameters and C# Custom Iterators: A Match Made In Heaven! - Leonard Lobel
• Table Value Parameter Use With C# - Jignesh Trivedi
• Using Table-Valued Parameters in SQL Server and .NET - Erland Sommarskog

Answer 2

SQLZim 的解决方案应该可以工作。不过既然他没提，那我就指出错误的原因是这行：

Mast.purreq_date Between ' + @DateFrom + ' And ' + @DateTo + ' And

您需要将日期时间变量转换/转换为 nvarchar，并用单引号将它们括起来。