SQL select statement to a parameter - sql-server

Question

I am trying to build a parameter, that contains a comma separated list columns, so I can use this dynamically later on. However i'm having an issue writing my select query, into a parameter that can be used to a separate select.
This is my parameter, to define the comma seperated list;
DECLARE #sqlSrcCols VARCHAR(MAX)
SET #sqlSrcCols = '
SELECT STUFF((SELECT '','' + a.sourceName
FROM #matchedFields a
FOR XML PATH('''')), 1, 1, '''') AS listStr'
This outputs a comma seperated list like so;
abc,cde,dfg,thy
I want to then reference that list, in a query like below:
DECLARE #sqlSelect VARCHAR(MAX) = 'SELECT ' + #sqlSrcCols + 'FROM a.TableName WHERE ExpDat = ''2020-01-01'' '
EXEC(#sqlSelect)
Although I can't use #sqlSrcCols within my query, and I can't use EXEC(#sqlSrcCols).
Any help welcomed.

Answer 1

At a guess, but I think what you actually mean to do is:
DECLARE #sqlSrcCols nvarchar(MAX); --Fixed datatype
SET #sqlSrcCols = STUFF((SELECT N',' + QUOTENAME(mF.sourceName) --Quoting is important
FROM #matchedFields mF --"a" for matchedFields?
FOR XML PATH(N''), TYPE).value('.', 'nvarchar(MAX)'),1,1,''); --used TYPE, in case of any odd characters
DECLARE #sqlSelect nvarchar(MAX);
SET #sqlSelect = N'SELECT ' + #sqlSrcCols + N' FROM a.TableName WHERE ExpDat = ''20200101'';'; --ISO dates are better, they won't fail depending on language/data type
--PRINT #SQL; --You debugging friend
EXEC sp_executesql #SQL; --Don't use EXEC(#SQL), use sp_executesql so you can parametrise when needed.
You weren't setting the value of #sqlSrcCols to be the names of the columns, you were setting it to the SQL statement. Then, when you concatenated the 2 variables, you ended up with a statement that would have looked like this:
SELECT
SELECT STUFF((SELECT ',' + a.sourceName
FROM #matchedFields a
FOR XML PATH('')), 1, 1, '') AS listStrFROM a.TableName WHERE ExpDat = '2020-01-01'
Which, as you can see, doesn't make any sense.
Bonus: I would actually write the above like you see below. The reason being is that then you have formatting in your dynamic SQL too; making it easier to debug. I have also parametrised #ExpDat, incase it needs to be (and this therefore shows you have to parametrise a dynamic statement):
DECLARE #sqlSrcCols nvarchar(MAX), --Fixed datatype
#CRLF nchar(2) = NCHAR(13) + NCHAR(10);
SET #sqlSrcCols = STUFF((SELECT N',' + #CRLF +
N' ' + QUOTENAME(mF.sourceName) --Quoting is important
FROM #matchedFields mF --"a" for matchedFields?
FOR XML PATH(N''), TYPE).value('.', 'nvarchar(MAX)'),1,10,N''); --used TYPE, in case of any odd characters
DECLARE #sqlSelect nvarchar(MAX);
SET #sqlSelect = N'SELECT ' + #sqlSrcCols + #CRLF +
N'FROM a.TableName' + #CRLF +
N'WHERE ExpDat = #ExpDat;'; --ISO dates are better, they won't fail depending on language/data type
--PRINT #SQL; --You debugging friend
DECLARE #ExpDat date = '20200101';
EXEC sys.sp_executesql #SQL, N'#ExpDat date', #ExpDat; --Don't use EXEC(#SQL), use sp_executesql so you can parametrise when needed.
If you're interested, you can find some of pointers on Dynamic SQL, what to do and not to do, in my article on SSC.