急求帮助！！！！！！！！！！！！！！！！

[qiudong_5210]

ALTER PROCEDURE [dbo].[sp_getVisitCountByDate]
 @TableName varchar(50),
 @StartDate datetime,
 @EndDate datetime

AS
BEGIN
	SET NOCOUNT ON;
	Declare @sql nvarchar(1000);
	SET @sql = 'SELECT * from ' + @TableName + ' where VisitDate between '+ Convert(varchar(50),@StartDate) +' and '+Convert(varchar(50),@EndDate)
	exec(@sql)
END

我在传入时间的时候，报错，谁能帮忙解决一下啊

[昵称被占用了]

ALTER PROCEDURE [dbo].[sp_getVisitCountByDate]
 @TableName varchar(50),
 @StartDate datetime,
 @EndDate datetime

AS
BEGIN
    SET NOCOUNT ON;
    Declare @sql nvarchar(1000);
    SET @sql = 'SELECT * from ' + @TableName + ' where VisitDate between '''+ Convert(varchar(50),@StartDate,120) +''' and '''+Convert(varchar(50),@EndDate,120) + ''''
    exec(@sql)
END

[昵称被占用了]

这样写法不安全，容易被注入，这是题外话

[qiudong_5210]

解决了，谢谢，忘了单引号的事了

[qiudong_5210]

[Quote=引用 2 楼 haiwer 的回复:]
这样写法不安全，容易被注入，这是题外话
[/Quote]

谢谢提醒，这是自己后台用的，简单了点，呵呵