Lo que pides es un código que mal utilizado puede usarse como vulnerabilidad de inyección de SQL. Siempre es importante evitar la concatenación de valores en ejecuciones de código SQL.
La solución ideal sería no usar ninguna variable (y dar formato al código) así.
SELECT A.DefaultTherapyCode,
A.CUSTOMFRAME,
A.ENABLEEDIT,
A.FREQUENCY,
A.INCLUDESIGNATURE,
A.ISATTACHMENT,
A.ISBILLABLE,
A.ISCUSTOM,
A.MAXLEN,
A.MINLEN,
A.NOTECODE,
A.NOTESID,
A.OVERRIDEATTENDANCE,
A.PROVIDERID,
A.STARTDAY,
A.STATUS,
A.UNSCHEDULEDONLY,
A.USECATEGORY,
A.NOTESTEMPLATE,
Coalesce(A.Description, B.Description) AS Description
FROM MdPrNotes A
LEFT OUTER JOIN MDBIOPSYCHOSOCIALSETUPHDR B ON A.NoteCode = B.BioCODE
WHERE STATUS = 'A'
AND (
(UnscheduledOnly <> 'Y')
OR (UnscheduledOnly IS NULL)
)
AND NotesID IN (
SELECT NotesIDs
FROM MdNotesByTherapy
WHERE TherapyCode = 'ADM'
);
La otra opción es utilizar una función para separar los valores concatenados en valores atómicos. Esto se puede hacer en versiones recientes de SQL Server mediante la función STRING_SPLIT().
SELECT A.DefaultTherapyCode,
A.CUSTOMFRAME,
A.ENABLEEDIT,
A.FREQUENCY,
A.INCLUDESIGNATURE,
A.ISATTACHMENT,
A.ISBILLABLE,
A.ISCUSTOM,
A.MAXLEN,
A.MINLEN,
A.NOTECODE,
A.NOTESID,
A.OVERRIDEATTENDANCE,
A.PROVIDERID,
A.STARTDAY,
A.STATUS,
A.UNSCHEDULEDONLY,
A.USECATEGORY,
A.NOTESTEMPLATE,
Coalesce(A.Description, B.Description) AS Description
FROM MdPrNotes A
LEFT OUTER JOIN MDBIOPSYCHOSOCIALSETUPHDR B ON A.NoteCode = B.BioCODE
WHERE STATUS = 'A'
AND (
(UnscheduledOnly <> 'Y')
OR (UnscheduledOnly IS NULL)
)
AND NotesID IN (
SELECT value
FROM STRING_SPLIT( @NotesByTherapy, ',')
);
En versiones anteriores, se puede usar la siguiente función creada por Jeff Moden y con mejoras de distintas personas incluyendo a Eirikur Eiriksson.
CREATE FUNCTION [dbo].[DelimitedSplit8K_LEAD]
--===== Define I/O parameters
(@pString VARCHAR(8000), @pDelimiter CHAR(1))
RETURNS TABLE WITH SCHEMABINDING AS
RETURN
--===== "Inline" CTE Driven "Tally Table” produces values from 0 up to 10,000...
-- enough to cover VARCHAR(8000)
WITH E1(N) AS (
SELECT 1 UNION ALL SELECT 1 UNION ALL SELECT 1 UNION ALL
SELECT 1 UNION ALL SELECT 1 UNION ALL SELECT 1 UNION ALL
SELECT 1 UNION ALL SELECT 1 UNION ALL SELECT 1 UNION ALL SELECT 1
), --10E+1 or 10 rows
E2(N) AS (SELECT 1 FROM E1 a, E1 b), --10E+2 or 100 rows
E4(N) AS (SELECT 1 FROM E2 a, E2 b), --10E+4 or 10,000 rows max
cteTally(N) AS (--==== This provides the "zero base" and limits the number of rows right up front
-- for both a performance gain and prevention of accidental "overruns"
SELECT 0 UNION ALL
SELECT TOP (DATALENGTH(ISNULL(@pString,1))) ROW_NUMBER() OVER (ORDER BY (SELECT NULL)) FROM E4
),
cteStart(N1) AS (--==== This returns N+1 (starting position of each "element" just once for each delimiter)
SELECT t.N+1
FROM cteTally t
WHERE (SUBSTRING(@pString,t.N,1) = @pDelimiter OR t.N = 0)
)
--===== Do the actual split. The ISNULL/NULLIF combo handles the length for the final element when no delimiter is found.
SELECT ItemNumber = ROW_NUMBER() OVER(ORDER BY s.N1),
Item = SUBSTRING(@pString,s.N1,ISNULL(NULLIF((LEAD(s.N1,1,1) OVER (ORDER BY s.N1) - 1),0)-s.N1,8000))
FROM cteStart s
;
GO