今天做這個乙個問題，需要動態使用sql語句，原來的解決方案是在程式中是用
if () {} else{}語句來解決
後來因為資料問題，沒辦法只有使用儲存過程。
源**是這樣的
這個儲存過程是對的，但是裡面有5個引數，但是在程式中除了時間外的另外三個引數都有可能為空，而且在為空的情況下需要能夠檢索查詢出所有資訊！
一時間真有點為難！
好在天無絕人之路，方法竟然找到了：
同樣的sql語句，做了小小的修改
--exec sp_supplyintostock '2007-03-01','2009-05-31','','',''
create procedure [dbo].[sp_supplyintostock]
@startdate varchar(50), --開始時間
@enddate varchar(50), --結束時間
@mfk_big varchar(50),--商品大類
@mfk_small varchar(50),--商品小類
@s_name varchar(50) --**商名稱
as begin
create table #temp1
(s_name varchar(50),
mfk_big varchar(50),
mfk_small varchar(50),
intomoney decimal(18,4)
)create table #temp2
(s_name varchar(50),
mfk_big varchar(50),
mfk_small varchar(50),
ug_intomoney decimal(18,4)
) --**商入庫資訊
insert into #temp1(s_name,mfk_big,mfk_small,intomoney)
select dbo.supply.cdesc as s_name, dbo.merchandisebig.cdesc as mfk_big, dbo.merchandisesmall.cdesc as mfk_small,
convert(numeric(20, 2), sum(dbo.stock_intostocklist.into_num * dbo.stock_intostocklist.into_price)) as intomoney
from dbo.stock_intostock inner join
dbo.stock_intostocklist on dbo.stock_intostock.into_code = dbo.stock_intostocklist.into_code inner join
dbo.merchandisebig inner join
dbo.merchandise on dbo.merchandisebig.mbcode = dbo.merchandise.mfk_big on
dbo.stock_intostocklist.m_code = dbo.merchandise.createcode inner join
dbo.merchandisesmall on dbo.merchandise.mfk_small = dbo.merchandisesmall.mscode inner join
dbo.supply on dbo.stock_intostock.supply_code = dbo.supply.scode
where (dbo.stock_intostocklist.into_status = 'c')
and dbo.stock_intostocklist.update_date >= @startdate
and dbo.stock_intostocklist.update_date <= @enddate
and (dbo.merchandisebig.cdesc = @mfk_big or @mfk_big ='')
and (dbo.merchandisesmall.cdesc = @mfk_small or @mfk_small='' )
and (dbo.supply.cdesc = @s_name or @s_name='')
group by dbo.supply.cdesc, dbo.merchandisebig.cdesc, dbo.merchandisesmall.cdesc
order by dbo.supply.cdesc
--**商退貨資訊
insert into #temp2(s_name,mfk_big,mfk_small,ug_intomoney)
select dbo.supply.cdesc as s_name, dbo.merchandisebig.cdesc as mfk_big,dbo.merchandisesmall.cdesc as mfk_small,
convert(numeric(20, 2), sum(isnull(dbo.stock_untreadgoodslist.ug_num * dbo.stock_untreadgoodslist.ug_price, 0))) as ug_intomoney
from dbo.supply inner join
dbo.stock_untreadgoodslist inner join
dbo.stock_untreadgoods on dbo.stock_untreadgoodslist.ug_code = dbo.stock_untreadgoods.ug_code on
dbo.supply.scode = dbo.stock_untreadgoods.supply_code right outer join
dbo.merchandisesmall inner join
dbo.merchandisebig inner join
dbo.merchandise on dbo.merchandisebig.mbcode = dbo.merchandise.mfk_big on
dbo.merchandisesmall.mscode = dbo.merchandise.mfk_small on dbo.stock_untreadgoodslist.m_code = dbo.merchandise.createcode
where (dbo.stock_untreadgoodslist.ug_status = 'c')
and dbo.stock_untreadgoodslist.update_date >= @startdate
and dbo.stock_untreadgoodslist.update_date <= @enddate
and (dbo.merchandisebig.cdesc = @mfk_big or @mfk_big ='')
and (dbo.merchandisesmall.cdesc = @mfk_small or @mfk_small='' )
and (dbo.supply.cdesc = @s_name or @s_name='')
group by dbo.supply.cdesc, dbo.merchandisebig.cdesc, dbo.merchandisesmall.cdesc
order by dbo.supply.cdesc
select t1.s_name,t1.mfk_big, t1.mfk_small,
convert(numeric(20,2),t1.intomoney - isnull (t2.ug_intomoney,0)) as intomoney
from #temp1 as t1
left outer join #temp2 as t2 on t2.s_name = t1.s_name
endgo
問題解決了！
執行儲存過程比即時SQL執行慢的解決方案
發生過這樣一件事，寫了乙個sql，查詢資料大概5秒，但是放到儲存過程裡面去了過後，查了5分鐘也沒給出結果，後來網上找解決方案，終於找到乙個解決方案。在儲存過程的引數那裡對引數進行乙個傳遞。反正他們說的引數嗅探是這個意思。這是儲存過程的機制。具體是什麼，大家去網上搜尋下。alter procedure...
SQL注入解決方案
sql作為字串通過api傳入給資料庫，資料庫將查詢的結果返回，資料庫自身是無法分辨傳入的sql是合法的還是不合法的，它完全信任傳入的資料，如果傳入的sql語句被惡意使用者控制或者篡改，將導致資料庫以當前呼叫者的身份執行預期之外的命令並且返回結果，導致安全問題。根據相關技術原理，sql注入可以分為平台...
SQL注入漏洞過程例項及解決方案
示例 public class jdbcdemo3 else public static boolean login string username,string password else catch sqlexception e return flag 解決方法，使用preparestatmen...