Question

您好我有以下数据要通过R连接粘贴到SQL查询中。

UKWinnersID<-c("1W167X6", "QM6VY8", "ZDNZX0", "8J49D8", "RGNSW9", 
"BH7D3P1", "W31S84", "NTHDJ4", "H3UA1", "AH9N7", 
"DF52B68", "K65C2", "VGT2Q0", "93LR6", "SJAJ0", 
"WQBH47", "CP8PW9", "5H2TD5", "TFLKV4", "X42J1" )

R中的查询/代码如下：

UKSQL6<-data.frame(sqlQuery(myConn, paste("SELECT TOP 10000 [AxiomaDate]
                      ,[RiskModelID] ,[AxiomaID],[Factor1],[Factor2],[Factor3],[Factor4],[Factor5]
                      ,[Factor6],[Factor7],[Factor8],[Factor9],[Factor10],[Factor11],[Factor12]
                      ,[Factor13],[Factor14],[Factor15]FROM [PortfolioAnalytics].[Data_Axioma].[SecurityExposures]
                      Where AxiomaDate IN (
                        SELECT   MAX(AxiomaDate)
                        FROM     [PortfolioAnalytics].[Data_Axioma].[FactorReturns]
                                  GROUP BY MONTH(AxiomaDate), YEAR(AxiomaDate))
                      AND RiskModelID = 8
                      AND  AxiomaID IN(",paste(UKWinnersID, collapse = ","),")")))

我在上面代码的最后一行粘贴了UKWinnersID，但UKWinnersID的格式需要为（'1W167X6'，'QM6VY8'，'ZDNZX0'......等），单引号我不能开始工作。

Answer 1

考虑使用parameterized query包（RODBC的扩展名）运行RODBCext，假设这是正在使用的API。参数化查询不仅可以从SQL注入中隔离，还可以从代码中抽象出数据，并避免使用混乱的引用封装和字符串插值以及连接，以获得更清晰，可维护的代码。

对于20个ID中的每一个，下面将TOP 10000替换为TOP 500：

library(RODBC)
library(RODBCext)

conn <- odbcConnect("DBName", uid="user", pwd="password")

ids_df <- data.frame(UKWinnersID = c("1W167X6", "QM6VY8", "ZDNZX0", "8J49D8", "RGNSW9", 
                                    "BH7D3P1", "W31S84", "NTHDJ4", "H3UA1", "AH9N7", 
                                    "DF52B68", "K65C2", "VGT2Q0", "93LR6", "SJAJ0", 
                                    "WQBH47", "CP8PW9", "5H2TD5", "TFLKV4", "X42J1"))

# SQL STATEMENT (NO DATA)
query <- "SELECT TOP 500 [AxiomaDate], [RiskModelID], [AxiomaID], [Factor1],[Factor2]
                 , [Factor3], [Factor4], [Factor5], [Factor6], [Factor7], [Factor8]
                 , [Factor9], [Factor10], [Factor11], [Factor12]
                 , [Factor13], [Factor14], [Factor15]
          FROM [PortfolioAnalytics].[Data_Axioma].[SecurityExposures]
          WHERE AxiomaDate IN (
                   SELECT   MAX(AxiomaDate)
                   FROM     [PortfolioAnalytics].[Data_Axioma].[FactorReturns]
                   GROUP BY MONTH(AxiomaDate), YEAR(AxiomaDate)
                )
            AND RiskModelID = 8
            AND AxiomaID = ?"

# PASS DATAFRAME VALUES TO BIND TO QUERY PARAMETERS
UKSQL6 <- sqlExecute(conn, query, ids_df, fetch=TRUE)

odbcClose(conn)

或者，如果您确实需要使用IN()子句：

# SQL STATEMENT (NO DATA)
query <- paste("SELECT TOP 10000 

                  ...same as above...

                  AND AxiomaID IN (", paste(rep("?", nrow(ids_df)), collapse=", "), ")")

# TRANSPOSE DATA FRAME FOR COLUMN EQUAL TO ? PLACEHOLDERS
UKSQL6 <- sqlExecute(conn, query, t(ids_df), fetch=TRUE)

SQL查询的单引号R.

1 个答案: