sqlserver 针对预处理sql传入参数的处理方式

在编写sql中，经常需要对sql进行预处理，动态拼接字符串，那么要获取在这预处理之后返回的的某个值并且赋值，传入参数的语法

USE [OA]
GO
/****** Object:  StoredProcedure [dbo].[usp_oa_UserMessageProve_Update]    Script Date: 12/02/2014 10:45:19 ******/
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
/*
功能:更新用户证明数据，更新用户证明状态
2014.10.28 16:14 am
*/
ALTER PROC [dbo].[usp_oa_UserMessageProve_Update]
@msgid VARCHAR(10) 
,@userid VARCHAR(10)
,@state	VARCHAR(10)
,@remark VARCHAR(200)
,@filepath VARCHAR(200)
 AS 
 begin
	DECLARE 
	@tablename VARCHAR(100)
	,@provered INT 
	,@sqlstr NVARCHAR(1000)
	,@provepath VARCHAR(1000)
	,@NOT_PROVE INT  --未证明
	,@CANNOT_PROVE INT --无法完成
	,@HAS_PROVE INT --已证明
	--无法证明更新
	SELECT @NOT_PROVE=56,@CANNOT_PROVE=58,@HAS_PROVE=57
	select @tablename=tablename from ADM_F_GETUSERREADTABLE (@userid)
	IF @state = '1' -- state =1 执行无法证明操作
		BEGIN
			SET @sqlstr = 'update '+@tablename+' set proveremark='''+@remark+''',provered='+CAST(@CANNOT_PROVE AS VARCHAR(10)) 
					+ ' where UserID='+@userid + ' and MessageID='+@msgid			
			EXEC(@sqlstr)
		END
	ELSE IF @state = '2' -- state = 2 执行 按钮证明操作
		BEGIN
			SET @sqlstr = 'update '+@tablename+' set provered='+CAST(@HAS_PROVE AS VARCHAR(10)) 
					+ ' where UserID='+@userid + ' and MessageID='+@msgid			
			EXEC(@sqlstr)
		END
	ELSE IF @state = '3'  -- state = 3 执行 文件路径更新操作
		BEGIN
			SET @sqlstr = 'update '+@tablename+' set provered='+CAST(@HAS_PROVE AS VARCHAR(10))+',provepath = isnull(provepath,'''')+ '''+@filepath
			+','' where UserID='+@userid + ' and MessageID='+@msgid	
			EXEC(@sqlstr)
		END
	ELSE IF @state = '4' -- state = 4 执行文件删除更新操作
		BEGIN
			SET @sqlstr = 'select @provepath=provepath from '+@tablename+'  where UserID='+@userid + ' and MessageID='+@msgid	
			EXEC sp_executesql  @sqlstr,
			N'@provepath VARCHAR(1000) output',
			@provepath OUTPUT
			SET @provepath= REPLACE(@provepath,@filepath+',','')
			SET @sqlstr = 'update '+@tablename+' set provepath = '''+@provepath+''''
			IF @provepath = ''
				BEGIN
					SET @sqlstr +=',provered='+CAST(@NOT_PROVE AS VARCHAR(10))
				END
			SET @sqlstr +=' where UserID='+@userid + ' and MessageID='+@msgid
			PRINT @sqlstr
			EXEC(@sqlstr)
		END
 END