Mysql Stored Procedure Ignores Parameters and WHERE conditions - mysql

Question

I have the following which works great:
SET #param = '%string%';
SELECT *
FROM tbl
WHERE IF(#param IS NOT NULL, LIKE #param, TRUE);
However when I change to this:
DELIMITER //
CREATE PROCEDURE test(IN param VARCHAR(255))
BEGIN
SET #param = param;
SELECT *
FROM tbl
WHERE IF(#param IS NOT NULL, LIKE #param, TRUE);
END //
DELIMITER ;
CALL test('%string%');
All rows are returned as if there were no parameter passed in.
I assume that there is some limitation or restriction with MySQL that I am missing?

Answer 1

Not sure but please try this with prepared statement
DELIMITER //
CREATE PROCEDURE test(IN param VARCHAR(255))
BEGIN
SET #param = param;
SET #q = CONCAT("SELECT *
FROM tbl
WHERE IF(",#param," IS NOT NULL, LIKE ",#param,", TRUE)");
PREPARE stmt FROM #q;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
END //
DELIMITER ;

Answer 2

This statement is syntactically wrong and won't get compiled:
WHERE IF(#param IS NOT NULL, LIKE #param, TRUE);
and you can't just place variable values like that to construct an SQL statement.
You need a Prepared Statement to prepare and execute such statements.
Try the following: (you need to replace column_name with valid column name from your table.
DELIMITER //
DROP PROCEDURE IF EXISTS test //
CREATE PROCEDURE test( IN param VARCHAR( 255 ) )
BEGIN
SET #param = param;
SET #query = CONCAT( 'SELECT * FROM tbl WHERE column_name LIKE ' );
SET #query = CONCAT( #query, ' IF( \'', #param, '\' IS NOT NULL, \'' );
SET #query = CONCAT( #query, #param, '\', TRUE )' );
PREPARE stmt FROM #query;
EXECUTE stmt;
DROP PREPARE stmt; -- deallocate prepare stmt;
END;
//
DELIMITER ;
CALL test('%string%');
If you run select #query, it will return following statement:
SELECT * FROM tbl
WHERE column_name LIKE IF( '%string%' IS NOT NULL, '%string%', TRUE )