Passing values to dynamic query in SQL Server procedure - sql-server-2008

Question

CREATE TYPE TableVariable AS TABLE
(
id int identity(1,1),
field_ids INT,
value VARCHAR(MAX)
)
Type created successfully.
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
Alter PROCEDURE Testing
(
#TableVar TableVariable READONLY,
#C_id INT
)
AS
Declare #maxPK INT;
Declare #pk INT;
Declare #fid INT;
Declare #val VARCHAR(max);
Declare #Where VARCHAR(max);
Declare #SQL VARCHAR(MAX);
Set #pk = 1
BEGIN
BEGIN TRY
SET NOCOUNT ON;
Select #maxPK = count(*) From #TableVar
SELECT #maxPK
SELECT #C_id
Set #SQL = 'SELECT DISTINCT v1.e_id from values v1 inner join listings l ON v1.e_id =
l.e_id WHERE l.c_id='+ #C_id
SELECT #SQL
While #pk <= #maxPK
BEGIN
SELECT #fid= field_ids FROM #TableVar where id=#pk;
SELECT #val= value FROM #TableVar where id=#pk;
SELECT #fid
SELECT #val
SET #SQL += ' and exists (select 1 from values v#pk+1 where v1.e_id = #pk+1.e_id and #pk+1.f_id=#fid and(value=#val))'
Select #pk = #pk + 1
END
SELECT #SQL
EXECUTE SP_EXECUTESQL #SQL
END TRY
BEGIN CATCH
END CATCH
END
DECLARE #DepartmentTVP AS TableVariable;
INSERT INTO #DepartmentTVP VALUES (14567, 'first')
INSERT INTO #DepartmentTVP VALUES (145678, 'second')
SELECT *
FROM #DepartmentTVP
EXEC Testing #DepartmentTVP, 83
I executed the above procedure.Values are not passed to the query
This is my orginal query
select distinct
v1.e_id
from
values v1
inner join
listings l on v1.e_id = l.e_id
where
l.c_id = 83
and exists (select 1
from values v2
where v1.e_id = v2.e_id
and v2.f_id = 1780
and (value = N'Peppermint Whole Care Toothpaste'))
and exists (select 1
from values v3
where v1.e_id = v3.e_id
and v3.f_id = 22483
and (value = N'sasdfa'))
order by
l.id desc
and exists part will add dynamically.

Answer 1

If you are wanting a variable to be part of the text such as:
'select 1 from values v#pk+1 where v1.e_id = #pk+1.e_id'
Then you need to escape the string and add the variable -- but beware this is prone to SQL Injection attacks if you don't strictly control the source of the variable data!
Example:
'select 1 from values v'+convert(varchar(15),#pk+1)+' where v1.e_id = '+convert(varchar(15),#pk+1)+'.e_id'
If you simply want to pass the variable into the string such as:
'and v5.f_id=#fid and(value=#val))'
Then you leave those variables unescaped, and pass them into sp_executesql
Example:
exec sp_executesql #SQL, N'#fid int, #val varchar(max)', #fid=#fid, #val=#val
More info on sp_executesql and its parameters:
https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-executesql-transact-sql