将nvarchar值转换为int时转换失败

Question

声明@count nvarchar(max)

set @count ='select COUNT(*) from '+ @tablename+''

if( @count =0 )
begin 
  print 'fail'
end
else
begin
  print 'success'
end
end

@count变量未获得值0.它将错误显示为

将nvarchar值'select COUNT(*)from tablename'转换为数据类型int时转换失败.

Answer 1

DECLARE @Count INTEGER
DECLARE @nSQL NVARCHAR(1000)
SET @nSQL = 'SELECT @Count = COUNT(*) FROM ' + @tablename
EXECUTE sp_executesql @nSQL, N'@Count INTEGER OUT', @Count OUT

-- Now check @Count

对这样的动态sql要格外小心,因为你打开自己的sql注入.因此,请确保已清除@tablename.

一个安全检查就是这样,通过在尝试动态查询之前确保使用参数化查询存在表:

DECLARE @Count INTEGER
DECLARE @nSQL NVARCHAR(1000)
SET @nSQL = 'IF EXISTS(SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME=@TableName) 
    SELECT @Count = COUNT(*) FROM ' + @tablename + '
ELSE
    SELECT @Count = -1'

EXECUTE sp_executesql @nSQL, N'@TableName NVARCHAR(128), @Count INTEGER OUT', @TableName, @Count OUT

如果@Count然后出现在-1,你知道这是因为表名无效

编辑:
对sp_executesql的引用在这里