1

下面的查询会引发此错误：

Conversion failed when converting the varchar value 'query below that stops at WHERE tsv.Transition_ID =' to data type int

DECLARE @Language_ID INT
SELECT @Language_ID = dbo.BPE_F_Default_Language_GetOne()

DECLARE @Transition_ID int
SET @Transition_ID = -1

DECLARE @SQLSTR nvarchar(4000)
SELECT @SQLSTR = 'SELECT tsv.Transition_Set_Variable_ID
                        , tsv.Set_To_Variable_ID
                        , tsv.Transition_ID
                        , tl.Transition_Text
                        , tsv.Variable_ID_To_Change
                        , variable.Name
                        , tsv.Set_To_Variable_ID
                        , tsv.Set_To_Value_ID
                        , tsv.Changed_In_SP
                        , tsv.Set_To_Comment_Input
                        , tsv.Comment AS Assigned_Comment
                        , variable2.Name AS Set_To_Variable_Name
                        , value.Name AS Set_To_Value_Name
                        FROM BPE_T_VA_Variable AS variable 
                        INNER JOIN BPE_T_VA_Transition_Set_Variable AS tsv 
                            ON variable.Variable_ID = tsv.Variable_ID_To_Change
                        LEFT JOIN BPE_T_VA_Variable AS variable2 
                            ON tsv.Set_To_Variable_ID = variable2.Variable_ID
                        LEFT JOIN BPE_T_VA_Value AS value 
                            ON tsv.Set_To_Value_ID = value.Value_ID
                        INNER JOIN BPE_T_WF_Transition_Localisation AS tl
                            ON tsv.Transition_ID = tl.WF_Transition_ID
                        WHERE tsv.Transition_ID = ' + @Transition_ID + ' OR ' + @Transition_ID + ' = -1 
                        AND (' + @Column + ' LIKE ''%''' + @search_string + '''%'' )
                        AND tl.Language_ID = ' + @Language_ID + '
                        ORDER BY tsv.Transition_ID, variable.Name'
EXEC(@SQLSTR);

有谁知道这可能是什么？

4

4 回答 4

2

@Transition_ID是 a INT，您必须先将其转换为 a VARCHAR，然后再将其与字符串的其余部分连接起来。

但是，最好在查询中使用sp_executeSql和参数化@Transition_ID和@search_string参数。就目前而言，它很可能容易受到Sql Injection Attack的攻击。

此外，要非常小心您允许进入的值@Column，最好使用白名单，因为这不能以您使用它的方式进行参数化，而且它也会让您容易受到攻击。

于 2012-12-10T17:29:11.523 回答
0

由于您要将 an 连接INT到字符串，因此必须对其进行转换，否则会引发错误。

添加以下内容：

cast(@Transition_ID as varchar(50))

要制作完整的脚本：

DECLARE @Language_ID INT
SELECT @Language_ID = dbo.BPE_F_Default_Language_GetOne()

DECLARE @Transition_ID int
SET @Transition_ID = -1

DECLARE @SQLSTR nvarchar(4000)
SELECT @SQLSTR = 'SELECT tsv.Transition_Set_Variable_ID
                        , tsv.Set_To_Variable_ID
                        , tsv.Transition_ID
                        , tl.Transition_Text
                        , tsv.Variable_ID_To_Change
                        , variable.Name
                        , tsv.Set_To_Variable_ID
                        , tsv.Set_To_Value_ID
                        , tsv.Changed_In_SP
                        , tsv.Set_To_Comment_Input
                        , tsv.Comment AS Assigned_Comment
                        , variable2.Name AS Set_To_Variable_Name
                        , value.Name AS Set_To_Value_Name
                        FROM BPE_T_VA_Variable AS variable 
                        INNER JOIN BPE_T_VA_Transition_Set_Variable AS tsv 
                            ON variable.Variable_ID = tsv.Variable_ID_To_Change
                        LEFT JOIN BPE_T_VA_Variable AS variable2 
                            ON tsv.Set_To_Variable_ID = variable2.Variable_ID
                        LEFT JOIN BPE_T_VA_Value AS value 
                            ON tsv.Set_To_Value_ID = value.Value_ID
                        INNER JOIN BPE_T_WF_Transition_Localisation AS tl
                            ON tsv.Transition_ID = tl.WF_Transition_ID
                        WHERE tsv.Transition_ID = ' + cast(@Transition_ID as varchar(50)) + ' OR ' + cast(@Transition_ID as varchar(50)) + ' = -1 
                        AND (' + @Column + ' LIKE ''%''' + @search_string + '''%'' )
                        AND tl.Language_ID = ' + @Language_ID + '
                        ORDER BY tsv.Transition_ID, variable.Name'
EXEC(@SQLSTR);
于 2012-12-10T17:29:49.047 回答
0

将您的 Int 变量转换为 varchar：

SELECT @SQLSTR = 'SELECT tsv.Transition_Set_Variable_ID
                        , tsv.Set_To_Variable_ID
                        , tsv.Transition_ID
                        , tl.Transition_Text
                        , tsv.Variable_ID_To_Change
                        , variable.Name
                        , tsv.Set_To_Variable_ID
                        , tsv.Set_To_Value_ID
                        , tsv.Changed_In_SP
                        , tsv.Set_To_Comment_Input
                        , tsv.Comment AS Assigned_Comment
                        , variable2.Name AS Set_To_Variable_Name
                        , value.Name AS Set_To_Value_Name
                        FROM BPE_T_VA_Variable AS variable 
                        INNER JOIN BPE_T_VA_Transition_Set_Variable AS tsv 
                            ON variable.Variable_ID = tsv.Variable_ID_To_Change
                        LEFT JOIN BPE_T_VA_Variable AS variable2 
                            ON tsv.Set_To_Variable_ID = variable2.Variable_ID
                        LEFT JOIN BPE_T_VA_Value AS value 
                            ON tsv.Set_To_Value_ID = value.Value_ID
                        INNER JOIN BPE_T_WF_Transition_Localisation AS tl
                            ON tsv.Transition_ID = tl.WF_Transition_ID
                        WHERE tsv.Transition_ID = ' + cast(@Transition_ID as varchar) + ' OR ' + cast(@Transition_ID as varchar) + ' = -1 
                        AND (' + @Column + ' LIKE ''%''' + @search_string + '''%'' )
                        AND tl.Language_ID = ' + cast(@Language_ID as varchar) + '
                        ORDER BY tsv.Transition_ID, variable.Name'
于 2012-12-10T17:31:47.660 回答
0

这不会给你带来麻烦吗？

WHERE tsv.Transition_ID = ' + @Transition_ID + ' OR ' + @Transition_ID + ' = -1

我认为它必须是

WHERE tsv.Transition_ID = ' + @Transition_ID + ' OR tsv.Transition_ID =' + @Transition_ID + ' = -1

由于您将值设置为 -1，我希望 SQL（如果您打印它）看起来像：

WHERE tsv.Transition_ID = -1 OR -1 = -1

那是意图吗？

于 2012-12-10T17:39:56.810 回答