I'm creating a SSIS package which has two variables that is going to assign values into another SQL Command variable. The data source is an ODBC connector and the destination is an OLEDB connector.
Variables name:
- vPurchaseType (multiple values)
- vTransactionDate (single value)
- vPSourceQuery (SQL statement that is receive the others two variables)
One variable is a single row, this one it's working. The other variable is multiple values that is going to be ingested in a IN clause. But I'm not being able to pass multiple values in this one, I already tried Single row or Full result set but also doesn't work.
First variable result (vPurchaseType):
Query example:
SELECT Head FROM TableB
| Head |
|---|
| 12 |
| 9C |
| AA |
The second variable must be between single quotes in order to work.
Second variable result (vTransactionDate):
Query example:
SELECT Head FROM TableA
| Head |
|---|
| 2020-01-01 |
Third variable:
SELECT
ColA,
ColB,
ColC,
ColD
FROM TableC
WHERE ColC >= '"+ @[User::vTransactionDate] + "'
AND ColD IN ("+ @[User::vPurchaseType] +")
My package:

ColC >= '"+ @[User::vTransactionDate] + "'that is injection. You are injecting the variable into the string. A major security vulnerability. Always, always, always parametrise.