IN clause array parameter

Hi,

Is it possible to give a array as a parameter. for example in a IN clause?

For example:

var query = "SELECT * FROM myTable WHERE code IN (@datas)"

var params = [
    {
        name: 'datas',
        type: sql.VarChar,
        value: ['095578','095602']
    }
];


async.waterfall([
    function (callback) {
        createConnection(callback);
    },
    function (connection, callback) {
        var request = connection.request();

        params.forEach(function (param) {
            request.input(param.name, param.type, param.value);
        });

    request.query(query, function (err, recordset) {
    if (err) {

        callback(err, null);
    }
    else {
        callback(null, recordset);
    }
    });
    }
], function (err, recordset) {
    if (err) {
        next(err, null);
    }
    else {
        next(null, recordset);
    }
});

[goforgold]

For now, I’ve created a function which adds parameters dynamically like below. It is SQL Injection safe and can work for any type (no need to worry about quotes) as I’ve taken type as an argument.

Function:

/**
 * @param request sql request object
 * @param {string} columnName sql table column name
 * @param {string} paramNamePrefix prefix for parameter name
 * @param type parameter type
 * @param {Array<string>} values an array of values
 */
function parameteriseQueryForIn(request, columnName, parameterNamePrefix, type, values) {
  var parameterNames = [];
  for (var i = 0; i < values.length; i++) {
    var parameterName = parameterNamePrefix + i;
    request.input(parameterName, type, values[i]);
    parameterNames.push(`@${parameterName}`);
  }
  return `${columnName} IN (${parameterNames.join(',')})`
}

Usage:

var query = 'SELECT * FROM TableName WHERE ' + parameteriseQueryForIn(queryRequest, 'Name', 'nameParam', sql.NVarChar, ['Name1', 'Name2'])

I still wish if something like below should support, so programmers don’t have to all this and also don’t have to worry about sanitization to prevent injection.

var query = "SELECT * FROM myTable WHERE code IN (@datas)"

var param =  {
    name: 'datas',
    type: sql.VarChar,
    value: ['095578','095602']
};

request.input(param.name, param.type, param.value);

Thanks,

[zeroows]

I know it’s too late but for anyone else that’s looking for the solution to this problem you can use this

SELECT *
FROM myTable
WHERE code IN (
        SELECT value
        FROM STRING_SPLIT(@datas, ',')
    );

and provided as a comma-separated string