Question

please help me with writing this search sql stored procedure
procedure may have different number of parameters at different time
so could any body help me with writing this query. I don’t know how to concatenate parameters.
i am new to stored procedure

CREATE PROCEDURE searchStudent
-- Add the parameters for the stored procedure here
@course int=null,
@branch int=null,
@admissionYear varchar(max)=null,
@passingYear varchar(max)=null,
@userName varchar(max)=null,
@sex varchar(max)=null,
@studyGap varchar(max)=null,
@firstName varchar(max)=null,
@lastName varchar(max)=null
AS
BEGIN
-- SET NOCOUNT ON added to prevent extra result sets from
-- interfering with SELECT statements.
SET NOCOUNT ON;
DECLARE query STR DEFAULT null

IF @course IS NOT NULL
THEN query=
SELECT * FROM [tbl_students] WHERE 

END
GO

please complete the query so that it can have parameters which are having values and can search from database on the basis of parameters value. But parameter may vary every time depends on search criteria.

Answer 1

You would probably need to use Dynamic SQL to achieve this. First of all I would highly recommend reading this excellent article. http://www.sommarskog.se/dynamic_sql.html

You’re dynamic sql would be something like this;

   Declare @query varchar(max)

   Set @query = 'Select * From dbo.MyTable Where '

   If @Course Is Not Null
   Begin
    Set @query = @query + 'Course = ' + Convert(varchar(10), @Course)
   end

   If @Branch Is Not Null
   Begin
    Set @query = @query + ' and Branch = ' + Convert(varchar(10), @Branch )
   end

This is only an example! You will need to build in some checks to ensure that you have one (and only one) Where clause, you must ensure that the integer values are converted to string values correctly. You must also check that the parameters don’t have any special characters that could break the dynamic sql – like an apostrophe (')

Using dynamic SQL can be painful and very difficult to get right.

Good luck!