Question

I have a query where I want to return all the rows which are associated with a list of values. You could write this very simply as:

select * from TableA where ColumnB in (1, 2, 3, 5)

I could generate this query in C# and execute it. However this is obviously less than ideal as it doesn’t use parameters, it will suffer when trying to cache query plans and is obviously vulnerable to a SQL injection attack.

An alternative is to write this as:

select * from TableA where ColumnB = @value

This could be executed many times by C#, however this will result in N DB hits.

The only other alternative I can see is to create a temp table and join it that way, however I don’t see this point of this as it would be more complex and suffer from the same limitations as the first option.

I’m using SQL server and OLDB, creating the query isn’t the issue. I’m trying to create the most efficient process.

Which of these three methods is more efficient? Have I missed an alternative?

Answer 1

Assuming SQL Server 2008 or newer, in SQL Server, create a table type once:

CREATE TYPE dbo.ColumnBValues AS TABLE
(
  ColumnB INT
);

Then a stored procedure that takes such a type as input:

CREATE PROCEDURE dbo.whatever
  @ColumnBValues dbo.ColumnBValues READONLY
AS
BEGIN
  SET NOCOUNT ON;

  SELECT A.* FROM dbo.TableA AS A
    INNER JOIN @ColumnBValues AS c
    ON A.ColumnB = c.ColumnB;
END
GO

Now in C#, create a DataTable and pass that as a parameter to the stored procedure:

DataTable cbv = new DataTable();
cbv.Columns.Add(new DataColumn("ColumnB"));

// in a loop from a collection, presumably:
cbv.Rows.Add(someThing.someValue);

using (connectionObject)
{
    SqlCommand cmd        = new SqlCommand("dbo.whatever", connectionObject);
    cmd.CommandType       = CommandType.StoredProcedure;
    SqlParameter cbvParam = cmd.Parameters.AddWithValue("@ColumnBValues", cbv);
    cbvParam.SqlDbType    = SqlDbType.Structured;
    //cmd.Execute...;
}

(You might want to make the type a lot more generic, I named it specifically to make it clear what it is doing.)