I have written a stored procedure in sql server 2005 that searches for results.
SP
SELECT RTRIM(DEPT_DESC) DEPT_DESC, RTRIM(DEPT_ID) DEPT_ID
FROM T_ROLLUP_DEPT
WHERE DEPT_ID like @SearchText + '%' OR DEPT_DESC like '%%'
I added the ‘%%’ to help it search within columns.
ie If we are searching for Medical Controller, it would allow us to type ‘CONTRO’ and it would yield the results Medical Controller.
However, this has also caused some headaches. It seems that if I am searching by dept_id and type in ‘2’ it brings up ALL the results. Not only the department IDs that start with 2. Also if I type in a bunch of random numbers it also comes back with ALL the results.
Anyone know why and how this could be fixed?
That is like saying
.. OR 1 = 11 .. is there any search input for which it does not return all results? (I suspect not.)Perhaps it should be
.. OR DEPT_DESC like '%' + @SearchText + '%'instead? That would match whenDEPT_DESCcontains the search text ..1 Actually, it’s equivalent to saying
.. OR DEPT_DESC IS NOT NULLin thatLIKE '%%'will match every non-NULL string.