• Jason A. Long - Thursday, February 8, 2018 4:13 PM

    mxy - Thursday, February 8, 2018 3:54 PM

    hello all,

    need help to split data as below. i try to use charindex to find occurrence of 'And Id in (', but facing difficulty with close parenthesis due to multiple occurrences.

    DECLARE @test-2 NVARCHAR(4000)

    SET @test-2 =
        N'((User = ''active'') And Id in ( 1, 2, 3) And userstate=''CT'')'

    SELECT @test-2

    expected o/p
    ((User = 'active') And userstate='CT'), And Id in ( 1, 2, 3)

    #1 Why? What possible reason could you have for wanting to do this?
    #2 If you're doing what it looks like you're doing... DON'T!!! You're setting yourself up for a massive SQL injection vulnerability.

    i have app that sends dynamic filter statement (app is almost 10 years old), in clause is causing the problem where query takes over 5 mins. i was able to tune by removing in clause and adding a join. i use custom sql injection function(checks drop , create, exec etc) to make sure nothing is injected from the front end.