Passing parameter to SQL select statement IN clause acts weird.

Question

I've got the following query that returns 2 records (in DataSet's query builder)

SELECT        EmpID, Name, id
FROM          Users
WHERE        (CAST(id AS Varchar(20)) IN ('5688','5689'))

Now if I do the same query passing the parameter instead from code behind: String param = "'5688','5689'"; it returns null.

WHERE        (CAST(id AS Varchar(20)) IN (@param))

I tried taking off the very first and last ', but that did not make a diffrence.

!!!id is a unique PK!!!

Anyone's got a clue?

Giotto

Could you please post the code that contains the specified parameters? – Godart

Answer 1

The solution I found is quite simple, this works like a charm and there's no need for sps or other functions;

SQL:

SELECT whatever 
FROM whatever
WHERE (PATINDEX('%''' + CAST(id AS Varchar(20)) + '''%', @param) > 0)

C#:

String param = "'''1234'',''4567'''";
dataTable1 = tableAdapter1.getYourValues(param);

Giotto

Here's a pretty comprehensive discussion on ways to do this. #338204 – Giustino

This is just what I needed. My dataset designer kept defaulting my parameter to be DbType = Object, which the SQL didn't like so I had to update the parameter to be DbType = String, but then it worked like a charm. – Durstin

Answer 2

A variable is not allowed in the IN clause.
You are expecting the values as a comma delimited string you could use the split function (user defined and non-standard) to join them with the original tables:

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=326300&SiteID=1

For more information you can visit this

Tuinenga

Answer 3

('5688','5689') is an array of values.

Defining String param = "'5688','5689'"; and using it as (@param) makes ('5688','5689') a string. Which wont work.

Odessaodetta

Answer 4

Bibhas is correct. For me this worked:

string param="'1234','4567'"; we can't use param as SQL Parameter(@param).

command = new SqlCommand("SELECT * FROM table WHERE number IN (" + param + ")", connection);

command.ExcecuteReader();

Carrie

You append your values directly into SQL but we try to pass values by parameter. In my opinion your SQL can injectable. – Radom