Parameterized WHERE clause in SQL Server Stored Procedure -


i have stored procedure details of invoices

some occasions list of invoices sending invoiceid in other occasions need list of invoices per search fields supplied user. send fields stored procedure , use parameters below. included 2 columns there more.

select * invoices          (@invoicenumber null or  i.invoicenumber =  @invoicenumber)     ,     (@pono null or i.pono = @pono) 

is there way send condition clause 1 parameter?

yes, possible dynamic sql, highly discourage that.

select * tbl @condition:

if considering write procedure

create procedure search_sp @condition varchar(8000)    select * tbl @condition 

just forget it. if doing this, have not completed transition use stored procedure , still assembling sql code in client.

it open application sql injection attacks.


Comments

Popular posts from this blog

javascript - How to get current YouTube IDs via iMacros? -

c# - Maintaining a program folder in program files out of date? -

emulation - Android map show my location didn't work -