必须声明标量变量日期以防万一

Question

我正在尝试用一年中几个月的当前期间更新一列。因此，我使用带有月份变量的 switch 语句。但是，我收到错误：

必须声明标量变量

我尝试了以下方法：

DECLARE @DATE_AP dateTime
DECLARE @month varchar(max)

SET @DATE_AP= DATEADD(year, 0, GETDATE())
SET @month_AP = DATENAME(Month, @DATE_AP)
SELECT CAST(@month as VARchar(10))

 select @periodsetvar = 'select CASE @month 

     when    ''October'' then 
     ''Update tbltimes set Periodyr = 01''

     when    ''November'' then 
     ''Update tbltimes set Periodyr  = 02''

     when    ''December'' then 
    ''Update tbltimes set Periodyr  = 03''

     when    ''January'' then 
    ''Update tbltimes set Periodyr  = 04''

     when    ''February'' then 
     ''Update tbltimes set Periodyr  = 05''

END'

exec (@periodsetvar)

和：

DECLARE @DATE_AP dateTime
DECLARE @month varchar(max)

SET @DATE_AP= DATEADD(year, 0, GETDATE())
SET @month_AP = DATENAME(Month, @DATE_AP)
SELECT CAST(@month as VARchar(10))

 select @periodsetvar = 'select CASE'+   ' '+ @month+'

     when    ''October'' then 
     ''Update tbltimes set Periodyr = 01''

     when    ''November'' then 
     ''Update tbltimes set Periodyr  = 02''

     when    ''December'' then 
    ''Update tbltimes set Periodyr  = 03''

     when    ''January'' then 
    ''Update tbltimes set Periodyr  = 04''

     when    ''February'' then 
     ''Update tbltimes set Periodyr  = 05''

END'

exec (@periodsetvar)

Answer 1

不要使用容易受到 SQL 注入影响的动态 SQL，而是使用如下简单的语句：

DECLARE @DATE_AP dateTime
Declare @periodsetvar char(2)

SET @DATE_AP= DATEADD(year, 0, GETDATE())

Set @periodsetvar =  CASE DATENAME(Month, @DATE_AP) 
                        when 'October' then '01'
                        when 'November' then '02'
                        when 'December' then '03'
                        when 'Janurary' then '04'
                        when 'February' then '05'
                     end
Update tbltimes 
set Periodyr  = @periodsetvar

如果您 100% 决定使用动态 SQL，那么您应该确保这样做更安全并且参数化，如下所示：

DECLARE @DATE_AP dateTime
DECLARE @month varchar(10)

SET @DATE_AP= DATEADD(year, 0, GETDATE())
SET @month = DATENAME(Month, @DATE_AP)

 select @periodsetvar = 'select CASE @month 

     when    ''October'' then 
     ''Update tbltimes set Periodyr = 01''

     when    ''November'' then 
     ''Update tbltimes set Periodyr  = 02''

     when    ''December'' then 
    ''Update tbltimes set Periodyr  = 03''

     when    ''January'' then 
    ''Update tbltimes set Periodyr  = 04''

     when    ''February'' then 
     ''Update tbltimes set Periodyr  = 05''

END'

exec sp_executesql @periodsetvar, N'@month varchar(10)', @month

sp_executesql 将允许您在动态 sql 中声明参数，使其执行起来更加安全。