如何使用带参数

Question

sp_executesql的我写的查询：

DECLARE @Col_Select NVARCHAR(10); 
SET @Col_Select = N'[od.orderID]'; 

DECLARE @Query NVARCHAR(4000); 
SET @Query = N'SELECT quantity, COUNT(o.orderID) FROM orders o LEFT OUTER JOIN [order details] od ON o.orderid = @Col_Select group by od.quantity'; 

EXEC sp_executesql @Query,@Col_Select 

什么是错我的查询？

我得到这个错误：

Incorrect syntax near 'od.orderI)SELECT quantity,COUNT(o.orderID) FROM orders o LEFT OUTER JOIN [order details'.

Answer 1

因为你正在建设，其中字段更改动态查询，这不能被正常的参数来实现。您必须使用该参数来构建查询字符串 - 如果您可以从用户输入提供@Col_Select以避免SQL注入攻击，请谨慎使用！

SET @Query=N'SELECT quantity,COUNT(o.orderID) FROM orders o LEFT OUTER JOIN [order details] od ON o.orderid = ' + @Col_Select + ' group by od.quantity';