12

i am creating a dynamic query in stored procedure. my stored procedure is as follows:

CREATE PROCEDURE `test1`(IN tab_name VARCHAR(40),IN w_team VARCHAR(40))
BEGIN
SET @t1 =CONCAT("SELECT * FROM ",tab_name," where team=",w_team);
 PREPARE stmt3 FROM @t1;
 EXECUTE stmt3;
 DEALLOCATE PREPARE stmt3;
END

when i try to run it with the following call:

call test1 ('Test','SPA');

i get the following error message:

Error Code: 1054. Unknown column 'SPA' in 'where clause'

i tested without where condition and it works fine, but with the where condition its not working, i tried using @ with the variable name but it still does not work.

Thanks for your help.

4 Answers 4

13

Error Code: 1054. Unknown column 'SPA' in 'where clause'

This happens when you do not enclose input string within quotes, and SQL engine tries to identify it as a column in the table being queried. But it fails as it can't find it.

But what happens when it finds such column?
It fetches results when it finds some matches on the column values.
Obviously this is not what one was expecting.

How to overcome this? Use Prepared Statements with dynamic input values.

You can use placeholders like ? in stored procedures too on dynamic input values to use with Prepared Statements. The engine will handle escape characters and other string values when assigned to or compared within SQL expressions.

You just need to re-assign procedure inputs to one or more session variables, as required.

Example on your procedure:

CREATE PROCEDURE `test1`( IN tab_name VARCHAR(40), IN w_team VARCHAR(40) )
BEGIN
  SET @t1 = CONCAT( 'SELECT * FROM ', tab_name, ' where team = ?' ); -- <-- placeholder
  SET @w_team := w_team;

  PREPARE stmt3 FROM @t1;
  EXECUTE stmt3 USING @w_team; -- <-- input for placeholder
  DEALLOCATE PREPARE stmt3;
END;
10

You missed to enclose the parameter w_team in WHERE clause.

Try like this:

SET @t1 =CONCAT("SELECT * FROM ",tab_name," where team='",w_team,"'");

Explanation:

Query from your code would be like:

SELECT * FROM Test where team=SPA

It will try find a column SPA which is not available, hence the error.

And we changed it to:

SELECT * FROM Test where team='SPA'
7
  • SET @t1 =CONCAT("SELECT col1 into '@'var1 FROM ",tab_name," where team='",w_team,"'"); var1 is always null, why is that?
    – Shann
    Apr 20, 2014 at 5:52
  • @Shann: What are you trying to do? Apr 20, 2014 at 5:56
  • i am trying to store the col1 into var1, i put the @ in '' because i was having error on stack.
    – Shann
    Apr 20, 2014 at 5:58
  • Try removing the single quote around @. Apr 20, 2014 at 6:01
  • 1
    It is prone to SQL injection if we concat using user input. Ravinder Reddy's answer prevents this. We should use placeholders and execute the prepared statement by passing input variables to it.
    – Prashanth
    Jun 11, 2018 at 13:42
6

Try this..

CREATE PROCEDURE `test1`(IN tab_name VARCHAR(40),IN w_team VARCHAR(40))
BEGIN
SET @t1 =CONCAT("SELECT * FROM ",tab_name," where team='",w_team,"'");
 PREPARE stmt3 FROM @t1;
 EXECUTE stmt3;
 DEALLOCATE PREPARE stmt3;
END

You are missing quotes around w_team variable..

you should print the statement that dynamically build so you can just copy printed statement and try so you can easily find this kind of problem.

select @t1 will print the statment that build dynamically..

0
0

you can add dynamic fields and condition by using CONCAT() MySQL function. I checked this is working fine.

 DELIMITER $$
 /*define procedure name*/
 CREATE PROCEDURE getSearchData()
 BEGIN
 
 DECLARE conditions varchar(1000);
 DECLARE selectField varchar(1000);
 DECLARE SQL_QUERY  varchar(1000);   

 /*define  default select and condition*/
 SET @selectField = 'status,id';
 set @conditions = ' where return_flight=0'; 

 SET @SQL_QUERY = CONCAT('SELECT ',@selectField, ' FROM flights ',@conditions);   
/* you can add more select fields and conditions according to your requirement */ 

PREPARE stmt1 FROM @SQL_QUERY ;
EXECUTE stmt1;
DEALLOCATE PREPARE stmt1;
END$$
DELIMITER ;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.