Home/ Questions/Q 1868148
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-17T06:38:55+00:00

I am trying to create the following select statement in a stored proc @dealerids

  • 0

I am trying to create the following select statement in a stored proc

@dealerids nvarchar(256)

SELECT * 
FROM INVOICES as I
WHERE convert(nvarchar(20), I.DealerID) in (@dealerids)

I.DealerID is an INT in the table. and the Parameter for dealerids would be formatted such as
(8820, 8891, 8834)

When I run this with parameters provided I get no rows back. I know these dealerIDs should provided rows as if I do it individually I get back what I expect.
I think I am doing 

   WHERE convert(nvarchar(20), I.DealerID) in (@dealerids)

incorrectly. Can anyone point out what I am doing wrong here?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You can’t use @dealerids like that, you need to use dynamic SQL, like this:

    @dealerids nvarchar(256) 

EXEC('SELECT *  
FROM INVOICES as I 
WHERE convert(nvarchar(20), I.DealerID) in (' + @dealerids + ')'

    The downside is that you open yourself up to SQL injection attacks unless you specifically control the data going into @dealerids.

    There are better ways to handle this depending on your version of SQL Server, which are documented in this great article.

    • 0