8

Working with a SqlCommand in C# I've created a query that contains a IN (list...) part in the where clause. Instead of looping through my string list generating the list I need for the query (dangerous if you think in sqlInjection). I thought that I could create a parameter like:

SELECT blahblahblah WHERE blahblahblah IN @LISTOFWORDS

Then in the code I try to add a parameter like this:

DataTable dt = new DataTable();
dt.Columns.Add("word", typeof(string));
foreach (String word in listOfWords)
{
    dt.Rows.Add(word);
}
comm.Parameters.Add("LISTOFWORDS", System.Data.SqlDbType.Structured).Value = dt;

But this doesn't work.

Questions:

  • Am I trying something impossible?
  • Did I took the wrong approach?
  • Do I have mistakes in this approach?

Thanks for your time :)

8 Answers 8

4

What you are trying to do is possible but not using your current approach. This is a very common problem with all possible solutions prior to SQL Server 2008 having trade offs related to performance, security and memory usage.

This link shows some approaches for SQL Server 2000/2005

SQL Server 2008 supports passing a table value parameter.

I hope this helps.

0
3

You want to think about where that list comes from. Generally that information is in the database somewhere. For example, instead of this:

SELECT * FROM [Table] WHERE ID IN (1,2,3)

You could use a subquery like this:

SELECT * FROM [Table] WHERE ID IN ( SELECT TableID FROM [OtherTable] WHERE OtherTableID= @OtherTableID )
1
  • Unfortunately the information is not on another table. Is the result of some data gathering. But is a good approach that I'll write down for future uses. Thanks
    – graffic
    Sep 17, 2008 at 14:04
1

If I understand right, you're trying to pass a list as a SQL parameter.

Some folks have attempted this before with limited success:

Passing Arrays to Stored Procedures

Arrays and Lists in SQL 2005

Passing Array of Values to SQL Server without String Manipulation

Using MS SQL 2005's XML capabilities to pass a list of values to a command

1
  • The first link talks about a table variable. This is what I've created with the DataTAble. But in this case I cannot make mssql to swallow it. I guess the idea is gonna be create a table guid,word. Insert there and then delte by guid.
    – graffic
    Sep 17, 2008 at 14:12
1
  • Am I trying something impossible?

No, it isn't impossible.

  • Did I took the wrong approach?

Your approach is not working (at least in .net 2)

  • Do I have mistakes in this approach?

I would try "Joel Coehoorn" solution (2nd answers) if it is possible. Otherwise, another option is to send a "string" parameter with all values delimited by an separator. Write a dynamic query (build it based on values from string) and execute it using "exec".

Another solution will be o build the query directly from code. Somthing like this:

StringBuilder sb = new StringBuilder();
for (int i=0; i< listOfWords.Count; i++)
{
    sb.AppendFormat("p{0},",i);
    comm.Parameters.AddWithValue("p"+i.ToString(), listOfWords[i]);
}

comm.CommandText = string.Format(""SELECT blahblahblah WHERE blahblahblah IN ({0})", 
sb.ToString().TrimEnd(','));

The command should look like:

SELECT blah WHERE blah IN (p0,p1,p2,p3...)...p0='aaa',p1='bbb'

In MsSql2005, "IN" is working only with 256 values.

1
  • On the bottom query I get an error on the first occurrence of p0. Feb 3, 2015 at 13:49
0

I would recommend setting the parameter as a comma delimited string of values and use a Split function in SQL to turn that into a single column table of values and then you can use the IN feature.

http://www.sqlteam.com/forums/topic.asp?TOPIC_ID=50648 - Split Functions

1
  • 1
    That's quite Sql Injection prone :(
    – graffic
    Sep 17, 2008 at 14:05
0

If you want to pass the list as a string in a parameter, you could just build the query dynamically.

DECLARE @query varchar(500) SET @query = 'SELECT blah blah WHERE blahblah in (' + @list + ')' EXECUTE(@query)

0
0

I used to have the same problem, I think there is now way to do this directly over the ADO.NET API.

You might consider inserting the words into a temptable (plus a queryid or something) and then refering to that temptable from the query. Or dynamically creating the query string and avoid sql injection by other measures (e.g. regex checks).

1
  • I'll go with the first option + a bulk sql insert. Perhaps this can save me some SQL I/O
    – graffic
    Sep 17, 2008 at 14:28
0

This is an old question but I've come up with an elegant solution for this that I love to reuse and I think everyone else will find it useful.

First of all you need to create a FUNCTION in SqlServer that takes a delimited input and returns a table with the items split into records.

Here is the following code for this:

ALTER FUNCTION [dbo].[Split]
(
    @RowData nvarchar(max),
    @SplitOn nvarchar(5) = ','
)  
RETURNS @RtnValue table 
(
    Id int identity(1,1),
    Data nvarchar(100)
) 
AS  
BEGIN 
    Declare @Cnt int
    Set @Cnt = 1

    While (Charindex(@SplitOn,@RowData)>0)
    Begin
        Insert Into @RtnValue (data)
        Select 
            Data = ltrim(rtrim(Substring(@RowData,1,Charindex(@SplitOn,@RowData)-1)))

        Set @RowData = Substring(@RowData,Charindex(@SplitOn,@RowData)+1,len(@RowData))
        Set @Cnt = @Cnt + 1
    End

    Insert Into @RtnValue (data)
    Select Data = ltrim(rtrim(@RowData))

    Return
END

You can now do something like this:

Select Id, Data from dbo.Split('123,234,345,456',',')

And fear not, this can't be susceptible to Sql injection attacks.

Next write a stored procedure that takes your comma delimited data and then you can write a sql statement that uses this Split function:

CREATE PROCEDURE [dbo].[findDuplicates]
    @ids nvarchar(max)
as
begin
    select ID
      from SomeTable with (nolock)
     where ID in (select Data from dbo.Split(@ids,','))
end

Now you can write a C# wrapper around it:

public void SomeFunction(List<int> ids)
{
    var idsAsDelimitedString = string.Join(",", ids.Select(id => id.ToString()).ToArray());

    // ... or however you make your connection
    var con = GetConnection();

    try
    {
        con.Open();

        var cmd = new SqlCommand("findDuplicates", con);

        cmd.Parameters.Add(new SqlParameter("@ids", idsAsDelimitedString));

        var reader = cmd.ExecuteReader();

        // .... do something here.

    }
    catch (Exception)
    {
        // catch an exception?
    }
    finally
    {
        con.Close();
    }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.