Member Avatar for Rambomst

I am trying to make a query which will search for the ID's 5, 6 and 23(Those are just random numbers and could potentially be more). Rather than making a loop in my code to query each separate ID I was wondering if it was possible to query them all at once and return each row for the individual IDs.

  • 3 Contributors
  • 2 Replies
  • 111 Views
  • 19 Hours Discussion Span
  • Latest Post Latest Post by sourceskill

Dani AI

Generated

Short answer: you can fetch all wanted IDs in a single query (as pointed out). The important part when the list is dynamic (as in ’s case, coming from Request.QueryString) is to never concatenate unchecked user input into SQL. Validate and pass the list safely so you avoid SQL injection and unexpected values.

Two practical patterns that work well with SQL Server:

  • If you can change the server side, pass a single CSV/JSON string to a stored procedure and split it inside SQL. On recent SQL Server versions STRING_SPLIT or OPENJSON are simple and safe if you TRY_CAST values to the correct type before joining back to your table.
DECLARE @csv NVARCHAR(MAX) = '5,6,23';

SELECT t.*
FROM YourTable t
INNER JOIN (
  SELECT TRY_CAST(value AS INT) AS id
  FROM STRING_SPLIT(@csv, ',')
  WHERE TRY_CAST(value AS INT) IS NOT NULL
) s ON t.ID = s.id;
  • If you must stay in Classic ASP, sanitize the QueryString first (only allow integers, drop duplicates), then pass that sanitized CSV as a single NVARCHAR parameter to a stored procedure that uses one of the split methods above. Example sanitizer in VBScript:
Function SanitizeIDs(qs)
  Dim arr, out, i, v
  arr = Split(qs, ",")
  out = ""
  For i = 0 To UBound(arr)
    v = Trim(arr(i))
    If IsNumeric(v) Then
      If out <> "" Then out = out & ","
      out = out & CInt(v)
    End If
  Next
  SanitizeIDs = out
End Function

Notes and tips: for very large lists, use a table-valued parameter or insert IDs into a temp table — large IN lists can be slow and may defeat index usage. Always treat QueryString data as untrusted: validate, cast to the correct type, and prefer parameterized or server-side splitting over raw string concatenation.

Recommended Answers

All 2 Replies

Member Avatar for rch1231

Hello,

All you have to do is select from a list like this:

Select * from table1
where ID in (5, 6, 23)
Member Avatar for sourceskill

I have the same question somewhat... except I need the query string to populate the values for the IN statement this is the code I have but it's not working and I'm stuck and am in DIRE need of an answer:
<%
Dim rsAuto__print
For i=1 to (Trim(UCase(Request.QueryString("print"))).Count
If (Trim(UCase(Request.QueryString("print"))) (i) = Trim(UCase(rsAuto.Fields.Item("vin").Value)) Then
rsAuto__print = Trim(UCase(Request.QueryString("print"))
End If
Next
%>
<%
Dim rsAuto
Dim rsAuto_cmd
Dim rsAuto_numRows

Set rsAuto_cmd = Server.CreateObject ("ADODB.Command")
rsAuto_cmd.ActiveConnection = MM_Regal_STRING
rsAuto_cmd.CommandText = "SELECT * FROM AUTODETA as t1 LEFT JOIN MAKES AS t2 ON t1.makesx = t2.makesx WHERE vin IN ("& rsAuto__print &")"
rsAuto_cmd.Prepared = true
rsAuto_cmd.Parameters.Append rsAuto_cmd.CreateParameter("param1", 200, 1, 255, rsAuto__print) ' adVarChar

Set rsAuto = rsAuto_cmd.Execute
rsAuto_numRows = 0
%>

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.