Concatenate variable in a query - SQL Server 2008

Question

My question is basic.

I am creating a stored procedure and have it the following variable:

@ConcatenarClausulaWhere

During the execution of the procedure, several conditions are concatenated in this variable to be inserted after the WHERE:

SELECT ID
FROM TABLE1
WHERE indStatus = 'True'
AND (Description LIKE '%' + @ STRING + '%')

My intention was to do something like:

SELECT ID
FROM TABLE1 The
WHERE indStatus = 'True'
AND (Description LIKE '%' + @ STRING + '%') + @ ConcatenarClausulaWhere

But, it is not possible. Why?

I am using SQL Server 2008

Aaron Bertrand · Accepted Answer · 2013-04-18 18:04:38Z

3

You need dynamic SQL to append a WHERE clause to a query. A SELECT statement is not just a string. You also need to be very wary of SQL injection here. How are you validating what users are entering into this where clause parameter?

DECLARE @sql NVARCHAR(MAX) = N'SELECT ID FROM dbo.TABLE1 
  WHERE indStatus = ''True'' AND (Description LIKE @String)'
  + @ConcatenarClausulaWhere;

EXEC sp_executesql @sql, N'@String NVARCHAR(MAX)', N'%' + @STRING + '%';

answered Apr 18, 2013 at 18:04

Aaron Bertrand

282k37 gold badges469 silver badges468 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Concatenate variable in a query - SQL Server 2008

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related