如何在 SQL 服务器中传递声明变量中包含的列

Question

我有一个 table Depots 看起来像这样：

DepotID	DepotName	DepotLocation	DepAlias
1	Ouland	Utsacity	Oula
2	Ingri	Utsacity	Inglas
3	Turks	Utsacity	Turku
4	tamps	Uusimaa	Tampere
5	Kokos	Uusimaa	Kokoola
6	Kaus	Olomba	Kaukana

我在声明的变量中存储了一个逗号分隔的列列表 @ValList

DECLARE @ValList varchar(8000);
SET @ValList = NULL

SELECT @ValList = COALESCE(@ValList + ', ','') + ColumnName 
FROM #list

@ValList returns DepotID, DepotName, DepLocation

我想将 @ValList 传递到 select 语句中，如下所示

SELECT @ValList FROM Depots

所以我得到

DepotID	DepotName	DepotLocation
1	Ouland	Utsacity
2	Ingri	Utsacity
3	Turks	Utsacity
4	tamps	Uusimaa
5	Kokos	Uusimaa
6	Kaus	Olomba

但我不断收到类似

的信息

(No column name)
DepotID, DepotName, DepLocation
DepotID, DepotName, DepLocation
DepotID, DepotName, DepLocation
DepotID, DepotName, DepLocation
DepotID, DepotName, DepLocation
DepotID, DepotName, DepLocation

我做错了什么？

Answer 1

您似乎对动态 TSQL 感兴趣。尝试使用 sp_executesql 例如

DECLARE @ValList varchar(8000);
SET @ValList = 'DepotID, DepotName, DepotLocation';

SELECT @ValList as ColumnNames;

DECLARE @MyQuery NVARCHAR(4000) = CONCAT(N'SELECT ',@ValList,N' FROM  Depots');

EXECUTE sp_executesql @MyQuery;

ColumnNames
DepotID, DepotName, DepotLocation

DepotID	DepotName	DepotLocation
1	Ouland	Utsacity
2	Ingri	Utsacity
3	Turks	Utsacity
4	tamps	Uusimaa
5	Kokos	Uusimaa
6	Kaus	Olomba

View working demo

让我知道这是否适合你。

Answer 2

不确定您可以或应该在多大程度上信任列列表的来源，但最安全的方法如下，您可以在其中检查 sys.columns 中每一列的存在：

CREATE TABLE #list(ColumnName sysname);

INSERT #list(ColumnName) 
VALUES(N'DepotID'),(N'DepotName'),(N'DepLocation');

DECLARE @sql nvarchar(max), @cols nvarchar(max) = N'';

SELECT @cols += N',' + QUOTENAME(c.name) 
  FROM #List AS l
  INNER JOIN sys.columns AS c
  ON l.ColumnName = c.name
  WHERE c.[object_id] = OBJECT_ID(N'dbo.Depots');
  
SET @sql = N'SELECT ' + STUFF(@cols, 1, 1, N'') 
  + N' FROM dbo.Depots';
  
EXEC sys.sp_executesql @sql;

示例db<>fiddle

保护自己免受 SQL 注射：Part 1 | Part 2

如何在 SQL 服务器中传递声明变量中包含的列

How to Pass columns contained in a declared variable in SQL Server

sql

sql-server

variables

dynamic-sql