How to add dynamic where clause

[simco]

Hi,

I am trying to dynamically add a where clause to any existing SQL SELECT statement (any SELECT that comes from the user). The purpose is to allow them to select only the records flagged in a certain way. And, since the flag field is the same in all tables, I was thinking that a solution might be adding a where clause to any incoming SELECT statement. My problem is where to place this WHERE, since the SELECT can be in any format (from multiple table, with/without join, subqueries, groupings etc).

Any idea is appreciated,
Thank you

S

 

[JayKusch]

delcare @SQLCommand VarChar(4000)

Set @SQLCommand = @TheirInputQuery + 'WHERE X = 123'

EXEC (@SQLCommand)

Thanks

J. Kusch

 

[simco]

What if the Select statement looks like:
"SELECT field1 from table1 inner join table2 on table1.id=table2.id group by field1"

and I need to restrict both table1 and table2 values. (adding it to the end is going to cause an error in this case)

See, that's my problem, it has to work in any situation, for all the tables involved.

Thank you anyway

 

[JayKusch]

You would have to do some pretty heavy, tricky parsing of their command to be able to build your WHERE clause. Almost a query building tool.

Thanks

J. Kusch

 

[Lekar]

JayKusck is right. Try finding the WHERE clause in the SQL string, and after that word, insert your clause.