Question

如何将表名作为参数传递给在oracle中对该表运行更新语句的存储

Answer 1

您需要使用Dynamic sql来实现这样的......

PROCEDURE UPDATE_My_Table
  (
      pTableName IN USER_TABLES.table_name%type,
      Param1 IN NVARCHAR2,
      Param2 IN NUMBER,
      Param3 IN NVARCHAR2
  )
  IS
  BEGIN
      execute immediate 
          'UPDATE '||pTableName
          ||' SET Column1 = :1, Column2 = :2'
          ||' WHERE Column3 = :3'
      using Param1 , Param2 , Param3;
  END;

Answer 2

不允许用户输入随机表名，或者您会发现他们正在更改您不期望的数据 - 至少您需要将您期望传递的表列入白名单：

PROCEDURE updateTables(
  table_name VARCHAR2,
  value1     VARCHAR2,
  value2     VARHCAR2,
  value3     VARCHAR2
)
IS
BEGIN
  IF table_name = 'table1' THEN
    UPDATE table1
    SET    col1 = value1
    WHERE  col2 = value2;
  ELSIF table_name = 'table2' THEN
    UPDATE table2
    SET    col1 = value1,
           col3 = value2
    WHERE  col2 = value3;
  ELSIF table_name = 'table3' THEN
    UPDATE table3
    SET    col1 = value3,
           col2 = value1,
           col3 = value2
    WHERE  col1 = value3;
  ELSE
    RAISE_APPLICATION_ERROR( -20001, 'Invalid Table Name' );
  END IF;
END;
/

在oracle存储过程中将表名作为参数传递

2 个答案: