SQL动态执行存储过程

SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
-- =============================================
-- Author:      Kenshin Cui
-- Create date: 2010.11.20
-- Description: Based on the specified table and column returns the query data
-- =============================================
CREATE PROCEDURE GetQueryDataByTableNameAndColumns
@tableName NVARCHAR(20),
@columns NVARCHAR(200)
AS
BEGIN
DECLARE @sql NVARCHAR(500)
SET @sql='SELECT '+@columns+' FROM '+@tableName
EXEC (@sql)
END
GO

SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
-- =============================================
-- Author:      Kenshin Cui
-- Create date: 2010.11.20
-- Description: Based on the specified table and column returns the query data
-- =============================================
CREATE PROCEDURE GetQueryDataByTableNameAndColumns2
@tableName NVARCHAR(20),
@columns NVARCHAR(200)
AS
BEGIN
DECLARE @sql NVARCHAR(500)
SET @sql='SELECT '+@columns+' FROM '+@tableName
EXEC sys.sp_executesql @sql
END
GO

SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
-- =============================================
-- Author:      Kenshin Cui
-- Create date: 2010.11.20
-- Description: By specifying the table name and column names to return the maximum value
-- =============================================
CREATE PROCEDURE GetMaxValueByTableNameAndColumns
@tableName NVARCHAR(20),
@columnName NVARCHAR(200)
AS
BEGIN
DECLARE @sql NVARCHAR(500)
DECLARE @outputParamDefine NVARCHAR(100)
DECLARE @maxValue NVARCHAR(50)
SET @sql='SELECT @maxValue=MAX('+@columnName+') FROM '+@tableName
SET @outputParamDefine='@maxValue NVARCHAR(50) OUTPUT'
EXEC sys.sp_executesql @sql,@outputParamDefine,@maxValue OUTPUT
SELECT @maxValue
END
GO

DECLARE @tableName NVARCHAR(20)
DECLARE @columns NVARCHAR(200)
DECLARE @sql NVARCHAR(500)--当使用sp_executesql执行时不能是VARCHAR(500)
SET @tableName='Products'
SET @columns='ProductName,UnitPrice'
SET @sql=N'SELECT '+@columns+' FROM '+@tableName
EXEC (@sql)                                                         --正确！！！
EXEC ('SELECT '+@columns+' FROM '+@tableName)                       --正确！！！
EXEC sys.sp_executesql @sql                                         --正确！！！但是如果@sql定义成varchar类型此句就会出错
EXEC sys.sp_executesql N'SELECT ProductName,UnitPrice FROM Products'--正确！！！直接执行语句，语句前面必须加“N”
EXEC sys.sp_executesql N'SELECT '+@columns+' FROM '+@tableName      --错误！！！不能执行sql拼接，即使前面加N