First Stored procedure with parameter in MySQL - mysql

Question

this is my query in MySQL on table tbl_T367
mysql> SELECT
oID,
xName
FROM
`tbl_T367`
WHERE
oID IN ('2')
AND xName IN ('T367');
+-----+-------+
| oID | xName |
+-----+-------+
| 2 | T367 |
+-----+-------+
1 row in set
i need create mysql stored procedure for the same output like above
my code below
DELIMITER $$
DROP PROCEDURE IF EXISTS my_sqrt$$
CREATE PROCEDURE my_sqrt(xName char(4), oID INT (11))
BEGIN
DECLARE xNamenew CHAR (4);
DECLARE IDnew INT (11);
SET #xNamenew = xName;
SET #IDnew = oID;
SET #s = CONCAT('SELECT * FROM tbl_', #xNamenew,
' WHERE oID IN (' + #IDnew + ') AND xName IN (' + #xNamenew + ')');
PREPARE stmt FROM #s;
EXECUTE stmt;
END
DELIMITER ;
but the result
Procedure execution failed
1146 - Table 'tbl_T3672' doesn't exist
why was the value of the second variable added to the table name?
mysql> SELECT
oID,
xName
FROM
`tbl_T3672`
WHERE
oID IN ('2')
AND xName IN ('T367');
1146 - Table 'tbl_t3672' doesn't exist
mysql>
how to do resolve this?
update
SET #s = CONCAT('SELECT * FROM tbl_', #xNamenew,
' WHERE oID IN (' , #IDnew , ') AND xName IN (' , #xNamenew ,')');
PREPARE stmt FROM #s;
EXECUTE stmt;
Procedure execution failed
1054 - Unknown column 'T367' in 'where clause'

Answer 1

Some issues (I haven't reviewed the original procedure thoroughly):
MySQL doesn't have a string concatenation operator. + is the addition operator thus your strings will be cast to numbers and added.
You're inflicting yourself SQL injection. Literal strings in SQL must be single-quoted, but that isn't something you need to take care yourself.
You're invoking the procedure from itself.
You are missing the ending delimiter.
DROP PROCEDURE IF EXISTS my_sqrt;
DELIMITER $$
CREATE PROCEDURE my_sqrt(xName char(4), oID INT (11))
BEGIN
DECLARE xNamenew CHAR (4);
DECLARE IDnew INT (11);
SET #xNamenew = xName;
SET #IDnew = oID;
SET #s = CONCAT('SELECT * FROM tbl_', #xNamenew,
' WHERE oID = ? AND xName = ?');
PREPARE stmt FROM #s;
EXECUTE stmt USING #IDnew, #xNamenew;
END
$$
DELIMITER ;
CALL my_sqrt('T367', '2');

Answer 2

Alvaro's answer shows you how to use parameterized queries to reduce the chances of injection. This procedure below is just for educational purposes to show you the difference between what you had and how close you were to getting it right.
There are some variables you didn't need. You can take the input and create a concatenated string. Since you would send '2', it may not be concatenated with the single quotes. So, you have to include single quotes in the concatenation like shown below.
delimiter $$
drop procedure if exists my_sqrt$$
create procedure my_sqrt(xName varchar(10), oID varchar(10))
begin
set #s = concat(
"select * from tbl_", xName,
" where oID in ('", oID, "')",
" and xName in ('", xName, "')"
);
prepare stmt from #s;
execute stmt;
end$$
delimiter ;
Again, this is for educational purposes. Use Alvaro's method.