帮我写这个查询

Question

CREATE PROCEDURE [dbo].[sp_SelectRecipientsList4Test] --'6DBF9A01-C88F-414D-8DD9-696749258CEF','Emirates.Description','0','5'
--'6DBF9A01-C88F-414D-8DD9-696749258CEF',
--'121f8b91-a441-4fbf-8a4f-563f53fcc103'
(
@p_CreatedBy UNIQUEIDENTIFIER,
@p_SortExpression NVARCHAR(100),
@p_StartIndex INT,
@p_MaxRows INT
)
AS
SET NOCOUNT ON;
IF LEN(@p_SortExpression) = 0 
SET @p_SortExpression = 'Users.Name Asc'

DECLARE @sql NVARCHAR(4000)
SET @sql='

DECLARE @p_CreatedBy UNIQUEIDENTIFIER

SELECT
Name,
POBox,
EmirateName,
TelephoneNo,
RecipientID,
CreatedBy,
CreatedDate,
ID

FROM
(

SELECT     Users.Name, Users.POBox, Emirates.Description As EmirateName, 

UserDetails.TelephoneNo, AddressBook.RecipientID,AddressBook.CreatedBy, AddressBook.CreatedDate, 

AddressBook.ID,
ROW_NUMBER() OVER(ORDER BY '+ @p_SortExpression +') AS Indexing

FROM         AddressBook INNER JOIN
                      Users ON AddressBook.RecipientID = Users.ID INNER JOIN
                      UserDetails ON Users.ID = UserDetails.UserID INNER JOIN
                      Emirates ON Users.EmiratesID = Emirates.ID
----WHERE       (AddressBook.CreatedBy = @p_CreatedBy)
) AS NewDataTable

WHERE Indexing > '+ CONVERT(NVARCHAR(10), @p_StartIndex) + 
' AND Indexing<=(' + CONVERT (NVARCHAR(10),@p_StartIndex ) + ' + '
+ CONVERT(NVARCHAR(10),@p_MaxRows)+') '

EXEC sp_executesql @sql

此查询没有给出任何错误,但也没有给出任何结果请帮助

Answer 1

您是否尝试分解声明,检查中间结果是否符合预期？这就是你调试复杂语句的方法......

例如,那里有一个嵌套的SELECT.如果您自己提交SELECT,它是否会打印预期的值？

编辑:有一个关于教人钓鱼的说法.'ck'和'n8wrl'今天给你吃鱼,现在请练习钓鱼明天喂你...

Answer 2

嗯,快速浏览一下:

WHERE Indexing > '+ CONVERT(NVARCHAR(10), @p_StartIndex) + ' AND Indexing<=(' + CONVERT (NVARCHAR(10),@p_StartIndex ) +...

看起来你正在寻找一个不可能的条件,与此不同:

WHERE Indexing > 5 AND Indexing <= 5

所以这可能就是为什么你没有得到任何行,但这个过程对于SQL注入攻击也是成熟的.基于可能未经验证的参数动态构建SQL是非常危险的.