mysql - Using variable in where clause stored procedure


mysql - Using variable in where clause stored procedure



im newbie in Stored Procedure.
I have simple example of my problem, in SP, I wrote this


BEGIN
DECLARE totalRows INT;
START
SELECT count(cont.contentCode) INTO totalRows FROM ms_content as cont WHERE entityCode = 'ACAW';
SELECT totalRows;
COMMIT;
END



I call it, success. I want to add condition where clause in variable. So I change my code to:


BEGIN
DECLARE totalRows INT;
START TRANSACTION;
SET @aa = concat("entityCode = 'ACAW'");
SELECT count(cont.contentCode) INTO totalRows FROM ms_content as cont WHERE @aa;
SELECT totalRows;
COMMIT;
END



SP return zero rows. Its possible to store condition in variable and put it in SELECT code?
Thank you.





You cannot parametrize entire WHERE clause. To do that you could use dynamic SQL but it will be quite dangerous and vulnerable to SQL Injection attacks. SELECT * FROM tbl WHERE @condition - SQL Server but idea is the same
– Lukasz Szozda
Jun 29 at 9:54



dynamic SQL





Read up on prepared statements here - dev.mysql.com/doc/refman/8.0/en/…
– P.Salmon
Jun 29 at 9:59





Ahh is that so... thanks for explanation :)
– Raissa Ditya Putri
yesterday









By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Comments

Popular posts from this blog

paramiko-expect timeout is happening after executing the command

Export result set on Dbeaver to CSV

Opening a url is failing in Swift