sql - 如何传递变量内字符串的参数值？

Question

有人可以帮助我如何将参数值传递到变量内的字符串

例如:

DECLARE @STR VARCHAR(MAX) = ''

DECLARE @ID INT

SET @STR = 'SELECT * FROM STUDENT WHERE STUDENT_ID=@ID'

这里我想将@ID作为参数传递给变量@STR

Answer 1

使用sp_executesql给参数赋值，这也将避免sql注入(inject)。试试这个

DECLARE @STR NVARCHAR(MAX) = ''

DECLARE @ID INT

SET @STR = 'SELECT * FROM STUDENT WHERE STUDENT_ID=@ID'

exec sp_executesql @str,'@ID INT',@ID