tags:

views:

109

answers:

1

My problem is similar to this one: I'm having trouble using paramaters in a full-text search with FormsOf(INFLECTIONAL: This query does not return anything.

DECLARE @SearchWord nvarchar(4000)
SET @SearchWord = 'tax'
SELECT listing_id, RANK, name, address, city, zip, heading, phone 
FROM listings a, 
FREETEXTTABLE(listings, *, 'FormsOf(INFLECTIONAL, @SearchWord')
WHERE [KEY] = a.listing_id
ORDER BY RANK DESC, name

but this one works OK

DECLARE @SearchWord nvarchar(4000)
SET @SearchWord = 'tax'
SELECT listing_id, RANK, name, address, city, zip, heading, phone 
FROM listings a, 
FREETEXTTABLE(listings, *, 'FormsOf(INFLECTIONAL, tax')
WHERE [KEY] = a.listing_id
ORDER BY RANK DESC, name

I found this question here

+1  A: 

You're searching for "@SearchWord" instead of "tax" !

Try this query:

DECLARE @SearchWord nvarchar(max)
SET @SearchWord = 'tax'

DECLARE @SearchString nvarchar(max)
SET @SearchString = 'FormsOf(INFLECTIONAL, "' + @SearchWord + '")'

SELECT listing_id, RANK, name, address, city, zip, heading, phone 
FROM listings a, 
FREETEXTTABLE(listings, *, @SearchString)
WHERE [KEY] = a.listing_id
ORDER BY RANK DESC, name
Andomar
Any idea how susceptible/immune this would be to SQL injection attacks? As per http://stackoverflow.com/questions/2176440/parameters-in-the-formsof-function-and-sql-injection
Andrew M
@Andrew M: Wether this code is open to injection depends on where @SearchWord comes from. I think it's up to the programmer to know about SQL injection; it makes little sense to discuss it in each and every question about SQL
Andomar
Sorry, it wasn't meant as a criticism, more an effort to understand the nature the parameter @SearchString being dynamically generated, and whether that offers the same protection of a more simple parametrized query. I'm also new to the syntax of the FormsOf function seeming being called from within a string.
Andrew M