Passing parameters to declated variable T-SQL - sql-server

Question

I have a small version of my problem in a stored procedure i would like to pass the parameters to as follows:
create procedure VariableTest
#Date1 DATETIME,
#Date2 DATETIME,
#CustomName1 NVARCHAR(100),
#CustomNum2 INT
AS
DECLARE #Condition NVARCHAR(MAX)
DECLARE #SQL NVARCHAR(MAX)
IF(LEN(#CustomName1) > 0)
SET #Condition = 'CustomerName = ' + #CustomName1;
IF(LEN(#CustomNum2) > 0 AND #CustomNum2 > 0)
SET #Condition = 'ClientNumber = ' + #CustomNum2;
SET #SQL =
'SELECT * FROM MyExampleTable ex
WHERE DateEx1 between ' + #Date1 + ' AND ' + #Date2 + '
AND ' + #Condition + '
ORDER BY ex.Sort'
exec #SQL
The problem i am running into, is that when i print the sql the dates do not have the a quotation around them and they are in datetime format, the other issue is that in the condition when the CustomerName is available the customer name comes out without quotes around them as well...
How can i make it so that in the sql string i can include those quotes around the parameters passed?.
OPTED SOLUTION:
create procedure VariableTest
#Date1 DATETIME,
#Date2 DATETIME,
#CustomName1 NVARCHAR(100),
#CustomNum2 INT
AS
DECLARE #Condition NVARCHAR(MAX)
DECLARE #SQL NVARCHAR(MAX)
IF(LEN(#CustomName1) > 0)
SET #Condition = 'CustomerName = #MyVal1';
IF(LEN(#CustomNum2) > 0 AND #CustomNum2 > 0)
SET #Condition = 'ClientNumber = #MyVal2';
DECLARE #MyParams NVARCHAR(200)
SET #MyParams = N'#date1 datetime, #date2 datetime, #MyVal1 NVARCHAR(200), #MyVal2 int';
SET #SQL =
'SELECT * FROM MyExampleTable ex
WHERE DateEx1 between #date1 AND #date2
AND ' + #Condition + '
ORDER BY ex.Sort'
EXECUTE exec sp_executesql
#SQL,
#MyParams,
#date1 = #Date1,
#date2 = #Date2,
#MyVal1 = #CustomName1,
#MyVal2 = #CustomNum2;

Answer 1

Your procedure is prone to sql-injection avoid concatenating parameters and use paramerterised queries like this....
CREATE PROCEDURE VariableTest
#Date1 DATETIME,
#Date2 DATETIME,
#CustomName1 NVARCHAR(100),
#CustomNum2 INT
AS
BEGIN
SET NOCOUNT ON;
DECLARE #SQL NVARCHAR(MAX);
SET #SQL = N'SELECT * FROM MyExampleTable '
+ N' WHERE DateEx1 between #Date1 AND #Date2 '
+ CASE WHEN LEN(#CustomName1) > 0
THEN N' AND CustomerName = #CustomName1 ' ELSE N'' END
+ CASE WHEN LEN(#CustomNum2) > 0 AND #CustomNum2 > 0
THEN N' AND ClientNumber = #CustomNum2 ' ELSE N'' END
+ N' ORDER BY [Sort] '
exec sp_executesql #SQL
,N'#Date1 DATETIME, #Date2 DATETIME
#CustomName1 NVARCHAR(100), #CustomNum2 INT '
,#Date1
,#Date2
,#CustomName1
,#CustomNum2
END

Answer 2

You can do this without dynamic query
SELECT * FROM MyExampleTable ex
WHERE DateEx1 between #Date1 AND #Date2
AND ((LEN(#CustomName1) > 0 AND CustomerName = #CustomName1)
or (LEN(#CustomNum2) > 0 AND #CustomNum2 > 0 and ClientNumber = #CustomNum2))
ORDER BY ex.Sort
Considering that both the condition should be applied in where clause if both the IF clause is satisfied
Dynamic query.
You need to add few more quotes to get the quotes around date
IF( Len(#CustomName1) > 0 )
SET #Condition = 'CustomerName = ''' + #CustomName1 + '';
IF( Len(#CustomNum2) > 0
AND #CustomNum2 > 0 )
SET #Condition = 'ClientNumber = '
+ CONVERT(VARCHAR(50), #CustomNum2);
SET #SQL = 'SELECT * FROM MyExampleTable ex
WHERE DateEx1 between '''
+ CONVERT(VARCHAR(50), #Date1) + ''' AND '''
+ CONVERT(VARCHAR(50), #Date2) + '''
AND '
+ #Condition + '
ORDER BY ex.Sort'
exec(#SQL)

Answer 3

The link Jeroen posted is an excellent resource for using dynamic SQL, and well worth reading (especially for avoiding the aforementioned injection attack).
That said, what you want to use here is the system stored procedure sp_executesql. The idea is you can essentially pass in (and out) variables so you don't have to concatenate them if you don't need to. The quick dirty explanation is you declare an extra variable to hold declarations for the parameters you want to pass in, then you execute sp_executesql indicating the sql text (first parameter), which variable holds your parameter declarations (second parameter) and as many variables as you declared (3rd through nth parameters). Here's the MSDN documentation on sp_executesql:
https://msdn.microsoft.com/en-us/library/ms188001.aspx
Then, your code would look like this instead:
create procedure VariableTest
#Date1 DATETIME,
#Date2 DATETIME,
#CustomName1 NVARCHAR(100),
#CustomNum2 INT
AS
DECLARE #Condition NVARCHAR(MAX)
DECLARE #SQL NVARCHAR(MAX)
declare #parameters nvarchar(2000)
IF(LEN(#CustomName1) > 0)
SET #Condition = 'CustomerName = ' + #CustomName1;
IF(LEN(#CustomNum2) > 0 AND #CustomNum2 > 0)
SET #Condition = 'ClientNumber = ' + #CustomNum2;
SET #SQL =
'SELECT * FROM MyExampleTable ex
WHERE DateEx1 between #Date1 AND #Date2
AND ' + #Condition + '
ORDER BY ex.Sort'
set #parameters = '#date1 datetime, #date2 datetime'
exec sp_executesql
#sql,
#params,
#date1,
#date2

Answer 4

I don't particularly like your opted solution.
NoDisplayName got it right by not using the dynamic query. Using dynamic queries means that you're not going to get the benefits of the SP query plan cache.
The non-dynamic query also has added benefit as it generates compile issues if you create the SP with query errors. The dynamic SQL hides all that.
The only time you'll get performance issues is if you're using a LIKE statement. Values like "%ABC", "AB%C" and "ABC%" all use different query plans. You can safely cache the query plan when using equals.
This is what I'd use:
SELECT *
FROM MyExampleTable ex
WHERE DateEx1 between #Date1 AND #Date2
AND ((LEN(#CustomName1) > 0 AND CustomerName = #CustomName1)
OR (#CustomNum2 > 0 and ClientNumber = #CustomNum2))
ORDER BY ex.Sort
I'd also make the parameter passed NULL if it didn't contain anything.