0

I am passing a comma-delimited list of values into a stored procedure. I need to execute a query to see if the ID of an entity is in the comma-delimited list. Unfortunately, I think I do not understand something.

When I execute the following stored procedure:

exec dbo.myStoredProcedure @myFilter=N'1, 2, 3, 4'

I receive the following error:

"Conversion failed when converting the varchar value '1, 2, 3, 4' to data type int."

My stored procedure is fairly basic. It looks like this:

CREATE PROCEDURE [dbo].[myStoredProcedure]
    @myFilter nvarchar(512) = NULL
AS
SET NOCOUNT ON
BEGIN
    -- Remove the quote marks so the filter will work with the "IN" statement
    SELECT @myFilter = REPLACE(@myFilter, '''', '')

    -- Execute the query
    SELECT
        t.ID,
        t.Name      
    FROM
        MyTable t
    WHERE
        t.ID IN (@myFilter)
    ORDER BY
        t.Name
END

How do I use a parameter in a SQL statement as described above? Thank you!

1
  • Have you searches so for somma delimited params? Oct 22, 2009 at 20:34

6 Answers 6

4

You could make function that takes your parameter, slipts it and returns table with all the numbers in it.

If your are working with lists or arrays in SQL Server, I recommend that you read Erland Sommarskogs wonderful stuff:

Arrays and Lists in SQL Server 2005

3

You need to split the string and dump it into a temp table. Then you join against the temp table.

There are many examples of this, here is one at random.

http://blogs.microsoft.co.il/blogs/itai/archive/2009/02/01/t-sql-split-function.aspx

3
  • Alternately, you can convert the comma-delimited list into XML and pass the XML into the stored procedure as an argument. You'd still be joining against the XML, but you'd at least avoid writing a split function. Oct 22, 2009 at 20:21
  • @iKnowFungFoo: Using XML means eating up characters with markup rather than content - runs the risk of not being able to send all content
    – OMG Ponies
    Oct 22, 2009 at 20:32
  • @iKnowKungFoo: On top of what @rexem said, if you have many data to send, markup becomes too big and thus the query slows down.
    – dance2die
    Oct 22, 2009 at 20:36
2

Absent a split function, something like this:

CREATE PROCEDURE [dbo].[myStoredProcedure]
    @myFilter varchar(512) = NULL -- don't use NVARCHAR for a list of INTs
AS
SET NOCOUNT ON
BEGIN
    SELECT
        t.ID,
        t.Name          
    FROM
        MyTable t
    WHERE
        CHARINDEX(','+CONVERT(VARCHAR,t.ID)+',',@myFilter) > 0
    ORDER BY
        t.Name
END

Performance will be poor. A table scan every time. Better to use a split function. See: http://www.sommarskog.se/arrays-in-sql.html

0

I would create a function that takes your comma delimited string and splits it and returns a single column table variable with each value in its own row. Select that column from the returned table in your IN statement.

0

I found a cute way of doing this - but it smells a bit.

declare @delimitedlist varchar(8000)
set @delimitedlist = '|1|2|33|11|3134|'

select * from mytable where @delimitedlist like '%|' + cast(id as varchar) + '|%'

So... this will return all records with an id equal to 1, 2, 33, 11, or 3134.

EDIT: I would also add that this is not vulnerable to SQL injection (whereas dynamic SQL relies on your whitelisting/blacklisting techniques to ensure it isn't vulnerable). It might have a performance hit on large sets of data, but it works and it's secure.

7
  • 1
    I think you would prevent SQL from using an index seek and force it to scan,
    – Andrew
    Oct 22, 2009 at 20:18
  • 1
    @Andrew: you're correct - it would perform miserably because it can't use an index due to using % at the start of the LIKE criteria.
    – OMG Ponies
    Oct 22, 2009 at 20:19
  • @andrew & @rexem - Performance can be a limiting factor in some scenarios, but for small tables it's fine. I would think it might perform miserably against a table with a million records... but not for a table with 20k.
    – Mayo
    Oct 22, 2009 at 20:22
  • I think we are having a dog-shed moment. Oct 22, 2009 at 20:32
  • 1
    The op also forgot to explicitly list columns and he didn't specify the table owner / schema. His nomenclature for variable/column/table names is lacking. He also should break up the statement into multiple lines for readability. I'm ashamed to share the same name.
    – Mayo
    Oct 23, 2009 at 1:48
0

I have a couple of blog posts on this as well, with a lot of interesting followup comments and dialog:

More on splitting lists

Processing list of integers

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.