--創(chuàng)建測(cè)試環(huán)境USE tempdb;GOIF OBJECT_ID('dbo.Orders') IS NOT NULL DROP TABLE dbo.Orders;GOCREATE TABLE dbo.Orders( orderid  int    NOT NULL PRIMARY KEY NONCLUSTERED, orderdate datetime  NOT NULL, empid   int    NOT NULL, custid  varchar(5) NOT NULL, qty    int    NOT NULL);CREATE UNIQUE CLUSTERED INDEX idx_orderdate_orderid ON dbo.Orders(orderdate, orderid);INSERT INTO dbo.Orders(orderid, orderdate, empid, custid, qty) VALUES(30001, '20020802', 3, 'A', 10);INSERT INTO dbo.Orders(orderid, orderdate, empid, custid, qty) VALUES(10001, '20021224', 1, 'A', 12);INSERT INTO dbo.Orders(orderid, orderdate, empid, custid, qty) VALUES(10005, '20021224', 1, 'B', 20);INSERT INTO dbo.Orders(orderid, orderdate, empid, custid, qty) VALUES(40001, '20030109', 4, 'A', 40);INSERT INTO dbo.Orders(orderid, orderdate, empid, custid, qty) VALUES(10006, '20030118', 1, 'C', 14);INSERT INTO dbo.Orders(orderid, orderdate, empid, custid, qty) VALUES(20001, '20030212', 2, 'B', 12);INSERT INTO dbo.Orders(orderid, orderdate, empid, custid, qty) VALUES(40005, '20040212', 4, 'A', 10);INSERT INTO dbo.Orders(orderid, orderdate, empid, custid, qty) VALUES(20002, '20040216', 2, 'C', 20);INSERT INTO dbo.Orders(orderid, orderdate, empid, custid, qty) VALUES(30003, '20040418', 3, 'B', 15);INSERT INTO dbo.Orders(orderid, orderdate, empid, custid, qty) VALUES(30004, '20020418', 3, 'C', 22);INSERT INTO dbo.Orders(orderid, orderdate, empid, custid, qty) VALUES(30007, '20020907', 3, 'D', 30);GO

--行轉(zhuǎn)列的靜態(tài)方案一：CASE WHEN,兼容sql2000select custid,sum(case when YEAR(orderdate)=2002 then qty end) as [2002],sum(case when YEAR(orderdate)=2003 then qty end) as [2003],sum(case when YEAR(orderdate)=2004 then qty end) as [2004]from ordersgroup by custid;GO--行轉(zhuǎn)列的靜態(tài)方案二：PIVOT,sql2005及以后版本select *from (select custid,YEAR(orderdate) as years,qty from orders) as ordpivot(sum(qty) for years in([2002],[2003],[2004]))as pGO

--既然是用到了動(dòng)態(tài)SQL,就有一個(gè)老話題:SQL注入。建一個(gè)注入性字符的判斷函數(shù)。CREATE FUNCTION [dbo].[fn_CheckSQLInjection]( @Col nvarchar(4000))RETURNS BIT --如果存在可能的注入字符返回true,反之返回falseASBEGINDECLARE @result bit; IF    UPPER(@Col) LIKE UPPER(N'%0x%') OR UPPER(@Col) LIKE UPPER(N'%;%') OR UPPER(@Col) LIKE UPPER(N'%''%') OR UPPER(@Col) LIKE UPPER(N'%--%') OR UPPER(@Col) LIKE UPPER(N'%/*%*/%') OR UPPER(@Col) LIKE UPPER(N'%EXEC%') OR UPPER(@Col) LIKE UPPER(N'%xp_%') OR UPPER(@Col) LIKE UPPER(N'%sp_%') OR UPPER(@Col) LIKE UPPER(N'%SELECT%') OR UPPER(@Col) LIKE UPPER(N'%INSERT%') OR UPPER(@Col) LIKE UPPER(N'%UPDATE%') OR UPPER(@Col) LIKE UPPER(N'%DELETE%') OR UPPER(@Col) LIKE UPPER(N'%TRUNCATE%') OR UPPER(@Col) LIKE UPPER(N'%CREATE%') OR UPPER(@Col) LIKE UPPER(N'%ALTER%') OR UPPER(@Col) LIKE UPPER(N'%DROP%') SET @result=1 ELSE SET @result=0 return @resultENDGO--行轉(zhuǎn)列的動(dòng)態(tài)方案一：CASE WHEN,兼容sql2000DECLARE @T TABLE (years INT NOT NULL PRIMARY KEY);INSERT INTO @T SELECT DISTINCT YEAR(orderdate) from orders;DECLARE @Y INT;SET @Y=(SELECT MIN(years) from @T);DECLARE @SQL NVARCHAR(4000)=N'';WHILE @Y IS NOT NULLBEGIN SET @SQL=@SQL+N',sum(case when YEAR(orderdate)='+CAST(@Y AS NVARCHAR(4)) +N' then qty end) as '+QUOTENAME(@Y); SET @Y=(SELECT MIN(years) from @T where years>@Y);ENDIF dbo.fn_CheckSQLInjection(@SQL)=0SET @SQL=N'SELECT custid'+@SQL+N' FROM orders group by custid'PRINT @SQLEXEC sp_executesql @SQLGO--行轉(zhuǎn)列的動(dòng)態(tài)方案二：PIVOT,sql2005及以后版本DECLARE @T TABLE (years INT NOT NULL PRIMARY KEY);INSERT INTO @T SELECT DISTINCT YEAR(orderdate) from orders;DECLARE @Y INT;SET @Y=(SELECT MIN(years) from @T);DECLARE @SQL NVARCHAR(4000)=N'';  --這里使用了xml處理來(lái)處理類組字符串SET @SQL=STUFF((SELECT N','+QUOTENAME(years) FROM @T FOR XML PATH('')),1,1,N'');IF dbo.fn_CheckSQLInjection(@SQL)=0SET @SQL=N'select * from (select DISTINCT custid,YEAR(orderdate) as years,qty from orders) as ordpivot(sum(qty) for years in('+@SQL+N'))as p';PRINT @SQL;EXEC SP_EXECUTESQL @SQL;GO

--列轉(zhuǎn)行的靜態(tài)方案：UNPIVOT,sql2005及以后版本SELECT * FROM dbo.pvtCustOrdersSELECT custid,years,qtyfrom dbo.pvtCustOrdersunpivot(qty for years in([2002],[2003],[2004]))as upGO--列轉(zhuǎn)行的動(dòng)態(tài)方案：UNPIVOT,sql2005及以后版本--因?yàn)樾惺莿?dòng)態(tài)所以這里就從INFORMATION_SCHEMA.COLUMNS視圖中獲取列來(lái)構(gòu)造行，同樣也使用了XML處理。DECLARE @SQL NVARCHAR(4000)=N'';SET @SQL=STUFF((SELECT N','+QUOTENAME(COLUMN_NAME ) FROM INFORMATION_SCHEMA.COLUMNSWHERE ORDINAL_POSITION>1 AND TABLE_NAME='PvtCustOrders'FOR XML PATH('')),1,1,N'')SET @SQL=N'SELECT custid,years,qty     from dbo.pvtCustOrders     unpivot(qty for years in('+@SQL+'))as up';PRINT @SQL;EXEC SP_EXECUTESQL @SQL;