Question

这是我搜索throgh所有数据库，表和列的存储过程。创建此过程时没有任何错误。

DELIMITER $$

DROP PROCEDURE IF EXISTS `mydb`.`get_table`$$

CREATE DEFINER=`root`@`%` PROCEDURE `get_table`(in_search varchar(50))
    READS SQL DATA
BEGIN
DECLARE trunc_cmd VARCHAR(50);
DECLARE search_string VARCHAR(250);
DECLARE db,tbl,clmn CHAR(50);
DECLARE done INT DEFAULT 0;
DECLARE COUNTER INT;
DECLARE table_cur CURSOR FOR 
SELECT concat('SELECT COUNT(*) INTO @CNT_VALUE FROM ',
              table_schema,'.', table_name, 
              ' WHERE ', column_name,' REGEXP ''',in_search,''''
         )
,table_schema,table_name,column_name
 FROM information_schema.COLUMNS
WHERE TABLE_SCHEMA NOT IN ('mydb','information_schema');
 DECLARE CONTINUE HANDLER FOR NOT FOUND SET done=1;
# #Truncating table for refill the data for new search.
PREPARE trunc_cmd FROM 'TRUNCATE TABLE temp_details';
EXECUTE trunc_cmd ;
OPEN table_cur;
table_loop:LOOP
 FETCH table_cur INTO search_string,db,tbl,clmn;
# #Executing the search
SET @search_string = search_string;
SELECT  search_string;
 PREPARE search_string FROM @search_string;
 EXECUTE search_string;
SET COUNTER = @CNT_VALUE;
 SELECT COUNTER;
IF COUNTER>0 THEN
# # Inserting required results from search to table
 INSERT INTO temp_details VALUES(db,tbl,clmn);
 END IF;
 IF done=1 THEN
 LEAVE table_loop;
 END IF;
END LOOP;
 CLOSE table_cur;
# #Finally Show Results
 SELECT * FROM temp_details;
 END$$

DELIMITER ;

但是在发生错误时调用此过程。

call get_table('aaa')

错误代码：1064您输入了错误你的SQL语法;检查手册对应于您的MySQL服务器用于正确语法的版本在第1行'删除REGEXP'aaa'附近（0毫秒）

Answer 1

“删除”来自哪里？你有一个具有该名称的column_name吗？如果是这样，请使用更好的名称，而不是保留名称，或在列名称周围使用令人讨厌的反引号或ANSI引号。

这样的构造容易受到SQL注入的攻击。</ p>

调用Mysql存储过程时出错

1 个答案: