dynamic-sql

问题 Executing dynamic SQL as follows in Stored Procedure: DECLARE @sqlCommand nvarchar(1000) DECLARE @city varchar(75) SET @city = \'London\' SET @sqlCommand = \'SELECT COUNT(*) FROM customers WHERE City = @city\' EXECUTE sp_executesql @sqlCommand, N\'@city nvarchar(75)\', @city = @city How do I use the count(*) column value as return value in the SP? 回答1: DECLARE @sqlCommand nvarchar(1000) DECLARE @city varchar(75) declare @counts int SET @city = 'New York' SET @sqlCommand = 'SELECT @cnt=COUNT(*

问题 I regularly need to delete all the data from my PostgreSQL database before a rebuild. How would I do this directly in SQL? At the moment I\'ve managed to come up with a SQL statement that returns all the commands I need to execute: SELECT \'TRUNCATE TABLE \' || tablename || \';\' FROM pg_tables WHERE tableowner=\'MYUSER\'; But I can\'t see a way to execute them programmatically once I have them. 回答1: FrustratedWithFormsDesigner is correct, PL/pgSQL can do this. Here's the script: CREATE OR

问题 I have a piece of dynamic SQL I need to execute, I then need to store the result into a variable. I know I can use sp_executesql but can\'t find clear examples around about how to do this. 回答1: If you have OUTPUT parameters you can do DECLARE @retval int DECLARE @sSQL nvarchar(500); DECLARE @ParmDefinition nvarchar(500); DECLARE @tablename nvarchar(50) SELECT @tablename = N'products' SELECT @sSQL = N'SELECT @retvalOUT = MAX(ID) FROM ' + @tablename; SET @ParmDefinition = N'@retvalOUT int

问题 I\'ve spent a good amount of time coming up with solution to this problem, so in the spirit of this post, I\'m posting it here, since I think it might be useful to others. If anyone has a better script, or anything to add, please post it. Edit: Yes guys, I know how to do it in Management Studio - but I needed to be able to do it from within another application. 回答1: I've modified the version above to run for all tables and support new SQL 2005 data types. It also retains the primary key names

问题 I\'m not sure how to achieve something like the following: CREATE OR REPLACE FUNCTION fnJobQueueBEFORE() RETURNS trigger AS $$ DECLARE shadowname varchar := TG_TABLE_NAME || \'shadow\'; BEGIN INSERT INTO shadowname VALUES(OLD.*); RETURN OLD; END; $$ LANGUAGE plpgsql; I.e. inserting values into a table with a dynamically generated name. Executing the code above yields: ERROR: relation \"shadowname\" does not exist LINE 1: INSERT INTO shadowname VALUES(OLD.*) It seems to suggest variables are

问题 Why would someone use WHERE 1=1 AND <conditions> in a SQL clause (Either SQL obtained through concatenated strings, either view definition) I\'ve seen somewhere that this would be used to protect against SQL Injection, but it seems very weird. If there is injection WHERE 1 = 1 AND injected OR 1=1 would have the same result as injected OR 1=1 . Later edit: What about the usage in a view definition? Thank you for your answers. Still, I don\'t understand why would someone use this construction

问题 I wrote a function that outputs a PostgreSQL SELECT query well formed in text form. Now I don\'t want to output a text anymore, but actually run the generated SELECT statement against the database and return the result - just like the query itself would. What I have so far: CREATE OR REPLACE FUNCTION data_of(integer) RETURNS text AS $BODY$ DECLARE sensors varchar(100); -- holds list of column names type varchar(100); -- holds name of table result text; -- holds SQL query -- declare more

问题 I want to pass a table name as a parameter in a Postgres function. I tried this code: CREATE OR REPLACE FUNCTION some_f(param character varying) RETURNS integer AS $$ BEGIN IF EXISTS (select * from quote_ident($1) where quote_ident($1).id=1) THEN return 1; END IF; return 0; END; $$ LANGUAGE plpgsql; select some_f(\'table_name\'); And I got this: ERROR: syntax error at or near \".\" LINE 4: ...elect * from quote_ident($1) where quote_ident($1).id=1)... ^ ********** Error ********** ERROR: