Parameterized WHERE clause in SQL Server Stored Procedure -
i have stored procedure details of invoices
some occasions list of invoices sending invoiceid in other occasions need list of invoices per search fields supplied user. send fields stored procedure , use parameters below. included 2 columns there more.
select * invoices (@invoicenumber null or i.invoicenumber = @invoicenumber) , (@pono null or i.pono = @pono)
is there way send condition clause 1 parameter?
yes, possible dynamic sql, highly discourage that.
if considering write procedure
create procedure search_sp @condition varchar(8000) select * tbl @condition
just forget it. if doing this, have not completed transition use stored procedure , still assembling sql code in client.
it open application sql injection attacks.
Comments
Post a Comment