参数化动态sql不返回任何结果

Question

在C#应用程序中,我创建了由SQL事件探查器捕获的以下参数化动态sql语句:

执行此语句不会返回任何结果:

exec sp_executesql N'SELECT IDWebFormAnswer FROM WebFormAnswers WHERE IDWebform = 55 AND IDWebFormQuestion = 478 AND (ANSWER = ''@answer0'')', N'@answer0 nvarchar(2)', @answer0=N'XL'

但是,如果我在下面简单地用XL替换@ answer0,我会返回4行.

exec sp_executesql N'SELECT IDWebFormAnswer FROM WebFormAnswers WHERE IDWebform = 55 AND IDWebFormQuestion = 478 AND (ANSWER = ''XL'')', N'@answer0 nvarchar(2)', @answer0=N'XL'

我不明白为什么会这样？我构建查询错了吗？

Answer 1

使用参数时,不应将其括在引号中.如果这样做,那么参数名称将成为文字字符串.使用您的代码,查询将搜索包含值"@ Answer0"的ANSWER,但没有.

 exec sp_executesql N'SELECT IDWebFormAnswer FROM WebFormAnswers 
      WHERE IDWebform = 55 AND IDWebFormQuestion = 478 AND 
      (ANSWER = @answer0)', N'@answer0 nvarchar(2)', @answer0=N'XL'