Issue with SQL Server escape character for SSRS parameter - sql-server

Question

In SSRS I have a parameter of office manager names that is populated by a stored procedure:
SELECT
MANAGER.office_manager_name
FROM (SELECT
ISNULL(REPLACE(PRACT_LOC.officemanagername, ',', ''), '*N/A') AS office_manager_name
FROM PRACTICELOCATIONS PRACT_LOC
UNION
SELECT
'*N/A') MANAGER
ORDER BY
MANAGER.office_manager_name
The parameter is populated like this:
*N/A, Smith John, Sharp Alex, O'Toole Tom
In SQL Server I have another SP that joins the office manager name from a table using a function splitter:
CREATE PROCEDURE IP
(#office_manager_name VARCHAR(4000))
AS
Select * from Table A
where ISNULL(REPLACE(A.officemanagername, ',', ''), '*N/A') IN (SELECT item FROM DBO.FNSPLIT(#officemanagername, ','))
The function splitter code looks like this:
ALTER FUNCTION [dbo].[fnSplit]
(
#sInputList VARCHAR(MAX), -- List of delimited items
#sDelimiter VARCHAR(MAX) = ',' -- delimiter that separates items
)
RETURNS #List TABLE (item VARCHAR(MAX))
BEGIN
DECLARE #sItem VARCHAR(MAX)
WHILE CHARINDEX(#sDelimiter,#sInputList,0) <> 0
BEGIN
SELECT
#sItem=RTRIM(LTRIM(SUBSTRING(#sInputList,1,CHARINDEX (#sDelimiter,#sInputList,0)-1))),
#sInputList=RTRIM(LTRIM(SUBSTRING(#sInputList,CHARINDEX(#sDelimiter,#sInputList,0)+LEN(#sDelimiter),LEN(#sInputList))))
IF LEN(#sItem) > 0
INSERT INTO #List SELECT #sItem
END
IF LEN(#sInputList) > 0
INSERT INTO #List SELECT #sInputList -- Put the last item in
RETURN
END
The issue I'm having is that any records with office manager Tom O'Toole do not show up in the report if I select All managers from the parameter. He does show up if I just select O'Toole Tom from the parameter list. I'm thinking it has to do with the apostrophe in his last name as he is the only manager with an apostrophe. If this is the case does anyone know how to use an escape character in this code to get O'Toole to populate?

Answer 1

I've found the issue using SQL Server Profiler.
What reporting is sending to server is this:
exec rsp_m_initialprocessxxxx #practice_manager=N'*N/A,O''''Toole Tom,Sharp Alex,Smith John'
As you can see instead of 2 apostrophes it's sending 4: O''''Toole Tom.
When splitting this sting using DBO.FNSPLIT you've got O''Toole Tom instead of O'Toole Tom and this finds no matches in your table.
The workaroud is the following: replace 4 apostrophes with 2 in your stored procedure like this, adding additional variable #practice_manager1:
declare #practice_manager1 varchar(4000) = (select replace(#practice_manager, replicate(char(39), 2), replicate(char(39), 1)));
Select * from dbo.A
where ISNULL(REPLACE(A.office_manager_name, ',', ''), '*N/A') IN (SELECT item FROM DBO.FNSPLIT(#practice_manager1, ','));
Char(39) is apostrophe, I use its code instead of the symbol for not becoming crazy with '''''
P.S. you are using SSRS 2016, not 2012
UPDATE1
I just tried this but it still doesn't work. It also doesn't work if I
just select Tom O'Toole instead of All, which previously worked.
I've tested this code one more time for both cases, here is my repro:
declare #t table (test_num int, name varchar(4000));
insert into #t values (1, 'O''Toole Tom'),
(2, '*N/A,O''''Toole Tom,Sharp Alex,Smith John');
SELECT test_num, name, item
FROM #t cross apply DBO.FNSPLIT(name, ',');
SELECT test_num, name, item
FROM #t cross apply DBO.FNSPLIT(replace(name, replicate(char(39), 2), replicate(char(39), 1)), ',');
I've inserted 2 strings for both cases and applied DBO.FNSPLIT to that strings directly and after making a replace, the second way worked in both cases:
UPDATE2
How to find the first parameter passed to stored procedure.
First of all ALTER your procedure, that will invalidate the old plan.
Then run it from SSRS with the problematic parameter. This parameter will be sniffed as it's the first execution. Then you can see it as ParameterCompiledValue graphically or in xml of your procedure plan.
Here is the code to grab the proc's plan from the cache:
select qp.query_plan
from sys.dm_exec_procedure_stats ps
cross apply sys.dm_exec_query_plan(ps.plan_handle) qp
where object_id = object_id('dbo.sp_test'); -- put here your sp name

Answer 2

The problem is "'" symbol in the Ton's name, try to add the code the replace bellow
REPLACE(#officemanagername,'''','''''')
----
CREATE PROCEDURE ##IP
(#office_manager_name VARCHAR(4000))
AS
Select * from Table A
where ISNULL(REPLACE(A.officemanagername, ',', ''), '*N/A') IN (SELECT item FROM DBO.FNSPLIT(REPLACE(#officemanagername,'''',''''''), ','))

Answer 3

I had the same problem with my stored procedure.
Reducing quotes in my procedure REPLACE(#param,'''','''''') works. But, calling my procedure outside of SSRS won't work for real 2 single quotes.
There is a better solution. You can join report parameters before passing them to your procedure:
Join(Parameters!Value.Value, ",")