Using Prepared statement in Dynamic view

Question

Here is my code

Drop procedure if exists test//
CREATE PROCEDURE test(IN woeid VARCHAR(15))
  BEGIN
   SET @w1 := woeid;
SET @sql = CONCAT('CREATE OR REPLACE VIEW temp 
                   AS
                   SELECT * 
                   FROM test_table gp
                   WHERE gp.name =', @w1);
PREPARE stmt FROM @sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
END//
Delimiter ;

call test('ABCD');

I am getting error as Error code: 1054. Unknown column 'ABCD' in 'where' clause

Please help.

Answer 1

It sounds as though you're needlessly using views, when some other approach would be more appropriate.

However, the reason it isn't working is that you haven't quoted your string literal, so the resulting SQL contains WHERE gp.name = ABCD whereas it at very least needs to be WHERE gp.name = 'ABCD'. You can use MySQL's QUOTE() function for this purpose, but it's better to parameterise the value:

DELIMITER //
DROP PROCEDURE IF EXISTS test//
CREATE PROCEDURE test(IN woeid VARCHAR(15))
BEGIN
  SET @w1:=woeid, @sql:=CONCAT('
    CREATE OR REPLACE VIEW temp AS
      SELECT * 
      FROM   test_table
      WHERE  name = ?
  ');
  PREPARE stmt FROM @sql;
  EXECUTE stmt USING @w1;
  DEALLOCATE PREPARE stmt;
  SET @w1:=NULL, @sql:=NULL;
END//
DELIMITER ;

CALL test('ABCD');