Question

I have a stored procedure for searching from multiple tables as

`ALTER PROCEDURE [dbo].[rdsp_Srchfld]
(
@strFldlst as nvarchar(max),
@strTblnm as nvarchar(max),
@intSrchStyle as int,
@strcond1 as nvarchar(250),
@strCond2 as nvarchar(250)=null,
@strCond3 as nvarchar(300)
)
AS
BEGIN 
declare @strSql as varchar(7000)


--Process
set @strSql = 'select Distinct ' + @strFldlst  + ' from ' + @strTblnm 
IF @intSrchStyle = 0
BEGIN
    SET @strSql = @strSql + ' where ' + @strcond1  + ' = ' + '''' + @strCond2 + '''' + ' order by ' + '' + @strcond3 + ''
END
ELSE IF @intSrchStyle = 1
BEGIN
    SET @strSql = @strSql + ' where ' + @strcond1 + ' like ' + '''' + @strCond2 + '%' + '''' + ' order by ' + '' + @strcond3 + ''
END



ELSE IF @intSrchStyle = 2 
BEGIN
    SET @strSql = @strSql + ' where ' + @strcond1  + ' like ' + '''' + '%' + @strCond2 + '%' + '''' + ' order by ' + '' + @strcond3 + ''
END

EXEC (@strSql)
END`

and passing the parameters from LINQ to Sql as

var rslt = from srch in custDC.rdsp_Srchfld(fldName, tblName, srchType, cond1, cond2, cond3) select srch;

Now I tried to build my programe, I am getting error as

Error   1   Could not find an implementation of the query pattern for source type 'int'.  'Select' not found.

Why I am getting the error and how can I implement it.

Answer 1

Do not do this. Abandon your approach now.

Start by reading this, http://www.sommarskog.se/dynamic_sql.html

Think about why Linq-to-SQL was created. Take a look at its successor EF.

Then make a model for your database from an established SQL Server supporting ORM. Then use the model to give you nice type checked code. Let the model do the dymanic SQL for you. If you have a special requirement or situation that the ORM does not cope with. Then consider writing a special SP to deal with it.

---

If you are going to persist with your approach at least understand what an SQL Injection attack is. Learn about sp_executesql and use it.

---

If Linq-to-SQL can’t get your dynamic SQL right, for whatever reason, it makes more sense to build the statement on the client/application layer, not in an SP. Look at the ExecuteQuery and ExecuteCommand methods of DataContext. If an ORM is too much, using vanilla ADO.Net and an SqlCommand has merit.