再问个sql问题！

[madong871020]

SqlDataReader sdr = dt.ExeReader("select did from a where u_id='" + dt.GetC("BY_uid") + "' and shenhe=5 ");
            while (sdr.Read())
            {
                if (dt.ExeSelect("count(mid)", "maidan", " did='" + sdr[0] + "' and is_check=0") == "1")
                {
                    num++;
                    saledid += "'" + sdr[0].ToString() + "'" + ",";
                    continue;
                }
            } 

 public void bind()
    {
         
        rp2.DataSource = dt.ExeSelectTable(" top 3 *", "Dingdan", " u_id='" + dt.GetC("BY_uid") + "' and shenhe=5 and did in(" + saledid.Substring(0, saledid.Length - 1)+ ")");
        rp2.DataBind();Response.Write(saledid);

    }

ExeSelectTable用到的存储过程
--查询
CREATE proc up_md_selectSql(@fName nvarchar(100),@tName nvarchar(50),@tiaojian nvarchar(1000)

)
as
declare @a nvarchar(1000)
set @a='select '+@fName+' from '+ @tName+' where 1=1 and '+@tiaojian
exec(@a)
GO
问：很有可能tiaojian 超过1000甚至10000啊 怎么办啊？
如果用text 太浪费了啊，大部分情况下它不超过100的，
难道直接用sql语句吗？
抱歉，我没分啦，就2分了

[yuloukong]

就用SQL拼接就好了吧

没必要什么都用 proc 吧?