I am working on an SQL query which uses multiple queries which use temp tables to prepare required data to the final report query. An application which uses DevExpress reporting engine, generates a "where" clause automatically according to some pre-settings. The result of the desired filter is something like this:
-- the part "where 1=1" is not generated. it is added for the purpose of visualizing and demonstrating
where 1=1 AND (#inv IN(4)) AND (#date = convert(datetime, '2021-02-21 23:59:59:000', 121) )
I would like to convert the generated filter into a nvarchar for farther string process, but the single quote in the convert function for the date will always ruin any trial of surrounding the statements with single quote(s) for escaping.
so my question is, considering that I have a statement like:
AND (#para1 IN(4)) AND (#date = convert(datetime, '2021-02-21 23:59:59:000', 121) )
how could I deal with it as string of type nvarchar using SQL Server for farther parsing?
knowing that I have no control over the code of the application which generates the filter string
Edit2:
Additionally knowing that adding quotes is only allowed at the beginning and end only,
and the Application which generates the filters is a compiled app. The app takes the original SQL query with a placeholder {0} to fill up the generated filters. Unfortunately, the app does not allow using next placeholder which should be {1}, so I am stuck to use the whole filter string using placeholder {0} only. So, If there is something in SQL or idea that could convert the generated filter string mentioned above to an nvarchar, so that I could write a function to take the values of each filter and reuse them into my SQL query
Using the camel sql component seems like a good thing in a project using camel. But i dont see the point for cases when dynamic sql is needed. Use case :
on front end user can
select a type of record only and submit search, in this case where clause is : "from table1 where col1 = valueX1"
also select a date range for offer start date so then where clause looks like "from table1 where col1 = valueX1 and dateCol between (...)"
and so on for other UI if values are given total of 10 different columns, in different combinations
I tried to use a dynamic sql figured out three choices:
1. using a receipient list so route is selected at run time, seemed over kill.
2. using the body as a sql and using the useMessageBodyForSql=true
3. using a custom prepareStatementStrategy
For 2 and 3 i was not able to send parameter names or specify headers or properties to be part of values to be used in Prepared statement.
For .2. had to give the sql like :
select c1, c2 ... from t1 where x = ? and y = ?
and then a java util list with the values in order.
So - is there any advantage to using this? Any feature of the sql component that makes it better to use than to directly use the spring jdbc template that it uses?
I would suggest to use Camel Templating to make the statements dynamic like that:
to("freemarker://sql/template.ftl")
.log("${body}")
.to("sql:ignored?useMessageBodyForSql=true");
Note that query parameters are represented by a ? instead of a # symbol if the statement comes from the body:
-- sql/template.ftl
select count(*) as count
from a_table
<#if headers.namePattern?has_content>
where name like :?namePattern
</#if>
You might also switch to the MyBatis component which supports advanced templating via MyBatis but this comes with a much higher overhead in terms of coding and configuration.
I am trying to search a MS SQL database column for 6 numbers. The data in the column is a string of characters example: ab01234555cd0122abc987654efg
Using RegEx : [0-9]{6}
Results are : 012345 and 987654
Here is my current MS SQL code:
SELECT * FROM users WHERE seo LIKE '%[0-9]{6}%'
The {6} does not work.
How can I use a regex qualifier to match the characters count?
SQL Server doesn't actually have REGEX functionality. You would need to repeat the pattern six times:
SELECT * FROM users WHERE seo LIKE '%[0-9][0-9][0-9][0-9][0-9][0-9]%'
SQL Server LIKE is does not handle regular expressions, though it can do pattern matching. Since regexp is not supported, you cannot do things like [0-9]{6}. Instead, you need to repeat your pattern, which would look like this: [0-9][0-9][0-9][0-9][0-9][0-9].
So your query would be:
SELECT * FROM users WHERE seo LIKE '%[0-9][0-9][0-9][0-9][0-9][0-9]%';
I'm trying to introduce LIKE clause with wildcards in SQL query that runs within Excel 2007, where parameters are taken from specific Excel cells:
SELECT Elen_SalesData_View.ItemCode, Elen_SalesData_View.ItemDescription,
Elen_SalesData_View.ItemValue, Elen_SalesData_View.Quantity,
Elen_SalesData_View.CustomerId, Elen_SalesData_View.CustomerName,
Elen_SalesData_View.SalesInvoiceId, Elen_SalesData_View.EffectiveDate,
Elen_SalesData_View.CountryId
FROM SM_Live.dbo.Elen_SalesData_View Elen_SalesData_View
WHERE (Elen_SalesData_View.EffectiveDate>=? And Elen_SalesData_View.EffectiveDate<=?)
AND (Elen_SalesData_View.CustomerName<>'PROMO')
AND (Elen_SalesData_View.ItemDescription LIKE '%'+?+'%')
The EffectiveDate parameters are running fine and bringing back data as expected. But since I introduced LIKE - query runs, but returns nothing.
It doesn't return any results without wildcards either (full description entered):
(Elen_SalesData_View.ItemDescription LIKE ?)
Is there a restriction to wildcards or LIKE clause? If so, is there a way around it? (I cannot use CONTAINS, as the ItemDescription field is not FULLTEXT)
Have a look at this reference which suggests that % itself is the wildcard character, although it may depend on the dialect of SQL you are using. If this is the case then your LIKE clause will simply be LIKE '%' but untested.
I've just got this to work by using the (Elen_SalesData_View.ItemDescription LIKE ?) syntax then having the cell that contains the parameter value include the wildcard characters. If you don't/can't include the wildcards then create a formula in a separate cell to wrap the value in % characters and use this cell for the parameter value.
Rhys
My query was correct. There was something wrong with the actual spreadsheet. After redoing all from scratch - it worked!
SELECT Elen_SalesData_View.ItemCode, Elen_SalesData_View.ItemDescription,
Elen_SalesData_View.ItemValue, Elen_SalesData_View.Quantity,
Elen_SalesData_View.CustomerId, Elen_SalesData_View.CustomerName,
Elen_SalesData_View.SalesInvoiceId, Elen_SalesData_View.EffectiveDate,
Elen_SalesData_View.CountryId
FROM SM_Live.dbo.Elen_SalesData_View Elen_SalesData_View
WHERE (Elen_SalesData_View.ItemDescription Like '%'+?+'%')
AND (Elen_SalesData_View.EffectiveDate>=?) AND (Elen_SalesData_View.EffectiveDate<=?)
AND (Elen_SalesData_View.CustomerName<>'PROMO')
In Management Studio, you can right click on the tables group to create a filter for the table list. Has anyone figured out a way to include multiple tables in the filter? For example, I'd like all tables with "br_*" and "tbl_*" to show up.
Anyone know how to do this?
No, you can't do this. When we first got Management Studio I've tried every possible combination of everything you could think of: _, %, *, ", ', &&, &, and, or, |, ||, etc...
You might be able to roll your own addon to SMSS that would allow you to do what you are looking for:
The Black Art of Writing a SQL Server Management Studio 2005 Add-In
Extend Functionality in SQL Server 2005 Management Studio with Add-ins
The first one is specifically for searching and displaying all schema objects with a given name so you might be able to expand upon that for what you are looking for.
I'm using SQL Server Management Studio v17.1 and it has a SQL injection bug in it's filter construction, so you can actually escape default
tbl.name like '%xxx%'
and write your own query (with some limitations). For example to filter tables that are ending with "_arch", "_hist", "_purge" I used following filter value
_arch') and RIGHT(tbl.name, 5) != N'purge' and RIGHT(tbl.name, 4) != N'hist' and not(tbl.name like N'bbb
You can use SQL Server Profiler to see the constructed query and adjust it as needed.
Not sure if this same bug is available in previous SQL Management Studio versions or when it will be fixed, but for now I'm happy with the result.
I've used Toad for SQL Server (freeware version) which has very nice filtering options.
At first it looks like it could use a CONTAINS query (e.g. "br_*" OR "tbl_*"), but it doesn't seem to. It seems to only support a value that is then passed into a LIKE clause (e.g. 'app' becomes '%app%').
The "sql injection" method still works (v17.5), but with a twist:
zzzz' or charindex('pattern1', name) > 0 or charindex('pattern2', name) > 0 or name like 'zzzz
(I used the 'zzzz' to bypass the '%')
It doesn´t work if '_' or '%' is used in the patterns (or anywhere on your code), because it will automatically be replaced by '[_]' or '[%]' before evaluation.
As others have said, you cannot do this in SQL Server Management Studio (up and including 2014).
The following query will give you a filtered list of tables, if this is all you need:
SELECT
CONCAT(TABLE_SCHEMA, '.', TABLE_NAME) AS TABLE_SCHEMA_AND_NAME,
TABLE_SCHEMA,
TABLE_NAME
FROM
INFORMATION_SCHEMA.TABLES
WHERE
TABLE_SCHEMA IN ('X', 'Y', 'Z') -- schemas go here
ORDER BY
TABLE_SCHEMA,
TABLE_NAME;
The SQL injection method still works (somewhat) as of SSMS 2017 v17.8.1, although it puts brackets around the % symbol, so it will interpret those literally.
If you're using the Name->Contains filter, Profiler shows:
... AND dtb.name LIKE N'%MyDatabase1%')
So, in the Name->Contains field: MyDatabase1') OR (dtb.name LIKE 'MyDatabase2 should do it for simple cases.
This is old I know, but it's good to know that it can works if you input just entering the "filter" text. Skip * or % or any other standard search characters, just enter br_ or tbl_ or whatever you want to filter on.
Your in luck, I just conquered that feat, although my success is small because you can filter by schema which would allow you see more than 1 table but you have to type the filter text in each time you want to change it.