SQL Query within VS TableAdapter Query Configuration Wizard

Question

Hi,

I am trying to write an SQL query within Visual Studio TableAdapter Query Wizard

My SQL query is:

    DECLARE @SQL varchar(255);

SET @SQL = ' SELECT * FROM dbAddress WHERE 1 = 1'

IF @ApexLine1 = ''
    BEGIN
        SET @SQL = @SQL + ' AND addLine1 IS NULL '
    END
ELSE
    BEGIN
        SET @SQL = @SQL + ' AND addLine1 = ''' + @ApexLine1 + ''''
    END

IF @ApexLine2 = ''
    BEGIN
        SET @SQL = @SQL + ' AND addLine2 IS NULL '
    END
ELSE
    BEGIN
        SET @SQL = @SQL + ' AND addLine2 = ''' + @ApexLine2 + ''''
    END

IF @ApexLine3 = ''
    BEGIN
        SET @SQL = @SQL + ' AND addLine3 IS NULL '
    END
ELSE
    BEGIN
        SET @SQL = @SQL + ' AND addLine3 = ''' + @ApexLine3 + ''''
    END

IF @ApexZip = ''
    BEGIN
        SET @SQL = @SQL + ' AND addPostCode IS NULL '
    END
ELSE
    BEGIN
        SET @SQL = @SQL + ' AND addPostCode = ''' + @ApexZip + ''''
    END

IF @ApexCity = ''
    BEGIN
        SET @SQL = @SQL + ' AND addLine4 IS NULL '
    END
ELSE
    BEGIN
        SET @SQL = @SQL + ' AND addLine4 = ''' + @ApexCity + ''''
    END

IF @ApexProv = ''
    BEGIN
        SET @SQL = @SQL + ' AND addLine5 IS NULL '
    END
ELSE
    BEGIN
        SET @SQL = @SQL + ' AND addLine5 = ''' + @ApexProv + ''''
    END

EXEC(@SQL)

I get the error:

'The Declare SQL contruct or statement is not supported'

If I remove the Declare statement I get error:

'The Set SQL construct or statement is not supported'

Is there a work around for this?

Thanks.

Answer 1

Anything like this:

SET @SQL = @SQL + ' AND addLine1 = ''' + @ApexLine1 + ''''

is EVIL. Don't do it. Variables like @ApexLine1 could contain anything, even something like this:

';DROP TABLE dbAddress--

Think very carefully about what would happen if someone entered something like that in your Address Line 1 field. The only correct solution here is to use the built-in sp_executesql stored procedure. Learn it, use it.

Aside from that, I think at least part of your problem might be that your @SQL variable is only 255 characters. It's easily possible your query is running out of space.