Put variable in quotes in SQL Query

Question

I have declared a variable vGetDate = 2021-03-20 and want to use this value in my query to fetch the record after that date. eg: (select * from ABC where UpdatedDate > vGetDate).

This query will not give the desired result as the Dates need to be in a single quote.

I can't touch the variable declaration part(vGetDate) in order to put the dates in quotes. I can manipulate the where condition but not sure how to put variables in quotes.

What you need is something like the PostgreSQL quote_literal function in order to defend against injection attack. I've asked about this before, and there isn't anything. It's a big gap, but the challenge with filling the gap is that different SQL dialects need different logic. — PhilHibbs
– PhilHibbs, Commented Mar 24, 2021 at 10:29

Gordon Linoff · Accepted Answer · 2021-03-23 15:30:59Z

1

In SQL Server, you would do:

declare @date date;

set @date = '2021-03-20';

select *
from ABC
where UpdatedDate > @date;

If you are calling the SQL using an interface, you should be able to pass the parameter in when you are executing the query.

answered Mar 23, 2021 at 15:30

Gordon Linoff

1.3m62 gold badges706 silver badges857 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

SHIVAM YADAV Over a year ago

I am getting date variable from a job and value is not in quotes. I can't touch this variable and can't maually put quotes in this . I can make use of this variable and can create a new variable with quotes but not sure how to do that . I want to utilize this value and compare it against another date in order to fetch the data.

Gordon Linoff Over a year ago

@SHIVAMYADAV . . . It is assigned to a parameter, presumably. You can convert to a date time.

SHIVAM YADAV Over a year ago

declare @date1 varchar(20) = activity.output(2021-03-22) select * from abc where format([UpdatedDtTm],'yyyy-MM-dd')>cast(@LastPaymentProcessedDT as datetime) I am using this but since date1 variable has date without quotes , thats why this where condition is not working fine

PhilHibbs Over a year ago

I don't think ADF has SQL parameters. All you can do is generate a string and pass it to SQL, and that opens the door to injection attacks. There is no quote_literal function.

Collectives™ on Stack Overflow

Put variable in quotes in SQL Query

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related