Question

我有customer表Cust_Id，Name，City，搜索基于以上三种中的任何一种或全部。

我应该去哪一个？

动态SQL：

declare @str varchar(1000)
set @str = 'Select [Sno],[Cust_Id],[Name],[City],[Country],[State] 
            from Customer where 1 = 1'
if (@Cust_Id != '')
    set @str = @str + ' and Cust_Id    =  ''' + @Cust_Id + ''''
if (@Name != '')
    set @str = @str + ' and Name like ''' + @Name + '%'''
if (@City  != '')
    set @str = @str + ' and City like ''' + @City + '%'''
exec (@str)

简单查询：

select
    [Sno],[Cust_Id],[Name],[City],[Country],[State]
from
    Customer
where
    (@Cust_Id  = '' or Cust_Id    =  @Cust_Id) and
    (@Name     = '' or Name     like @Name + '%') and
    (@City     = '' or City     like @City + '%')

我应该选择哪一个（1或2）以及有什么优势？

经过大家的建议后，这就是我最终得到的。

  DECLARE @str NVARCHAR(1000)
  DECLARE @ParametersDefinition NVARCHAR(500)
  SET @ParametersDefinition = N'@InnerCust_Id varchar(10),
                              @InnerName varchar(30),@InnerCity varchar(30)'


 SET @str = 'Select [Sno],[Cust_Id],[Name],[City],[Country],[State]
                                          from Customer where 1 = 1'

 IF(@Cust_Id != '')
    SET @str = @str + ' and Cust_Id = @InnerCust_Id'
 IF(@Name != '')
    SET @str = @str + ' and Name like @InnerName'
 IF(@City  != '')
    SET @str = @str + ' and City like @InnerCity'


-- ADD the % symbol for search based upon the LIKE keyword
SELECT  @Name = @Name + '%', @City = @City+ '%'

EXEC sp_executesql @str, @ParametersDefinition,
                      @InnerCust_Id = @Cust_Id,
                      @InnerName    = @Name,
                      @InnerCity    = @City;

注意：@Cust_Id，@Name和@City是传递给存储过程的参数

参考文献： http://blogs.lessthandot.com/index.php/DataMgmt/DataDesign/changing-exec-to-sp_executesql-doesn-t-p

http://www.sommarskog.se/dynamic_sql.html

http://msdn.microsoft.com/en-us/library/ms175170.aspx