SQL Query not accepting variable when using NOT IN clause - sql

Question

I am trying to pass a variable into a SQL NOT IN update statement to update a few table columns. I run the following commands and do not receive any errors. However, the update does the exact opposite of the commands.
$VMs = #()
foreach ($VM in VMs){
invoke-sqlcmd -Database $Database -server $SQLServer -Query "Update (table) set Column1= 1, Column2= 0, column3 = GETDATE() where table.vmid NOT IN ('${$vm.VMid}')"
}
I see that all the data is being passed into the variable. But, the NOT IN update statement is not updating my column correctly. Also, I do not receive any error messages when running my code.

Answer 1

Let me build on the helpful comments by Larnu and Santiago Squarzon.
First, the obligatory caveat:
Building SQL queries as self-contained strings bears the risk of SQL injection, i.e. inadvertent execution of potentially malicious queries.
This risk can be avoided by passing dynamic parts of the query as parameters to a parameterized statement (query).
While Invoke-Sqlcmd does support passing parameters via its -Variable parameter, it apparently does not prevent SQL injection, due to its string-based implementation for the sake of compatibility with the SQL Server CLIs, according to Invoke-Sqlcmd considered harmful.
The System.Data.SqlClient.SqlConnection .NET API offers true parameterized queries, as shown in this answer.
If you do need to construct a self-contained query string with parameter values embedded in it, be sure that you either fully control or implicitly trust those values.
In your particular case, given that the dynamic values are identifiers that you obtain yourself, there should be no security concern.
What is required in your case is to programmatically create a ,-separated list of the VM IDs each enclosed in '...', to be used as the RHS of the [NOT] IN T-SQL operator; e.g. (I'm using … to represent omitted parts:
… NOT IN '{f27286a7-…}', '{927286a7-…}'
As Santiago points out, there is no need for a loop:
# Get all VM IDs, as an array, courtesy of
# member-access enumeration
$vmIds = $VMs.vmid
# Transform the IDs to a string list such as:
# '{f27286a7-…}', '{927286a7-…}'
# See below for an explanation.
$quotedIdList = $vmIds -replace '^|$', "'" -join ', '
# Now embed this string in your query via string interpolation
# and execute it.
# Note that you could embed the expression above directly in the string, with $(...)
Invoke-Sqlcmd -Database $Database `
-Server $SQLServer `
-Query #"
UPDATE (table) SET Column1= 1, Column2= 0, column3 = GETDATE()
WHERE table.vmid NOT IN ($quotedIdList);"
"#
Explanation of the expression used to transform the array elements into single-line list (string) representation:
Note that, for added robustness, any ' characters embedded in the array elements are escaped as ''.
# -> String with the following verbatim content:
# 'three', 'o''clock'
#('three', "o'clock") -replace "'", "''" -replace '^|$', "'" -join ', '
-replace "'", "''" doubles all embedded ' characters in order to escape them.
-replace '^|$', "'" uses the regex capabilities of the -replace operator to effectively enclose each element in '...': ^|$ matches both (|) the position at the start (^) and end ($) of each element, and places a ' there.
-join ', ' then places the separator string between the resulting, quoted elements, using the -join operator.
Alternatively, use the form suggested by Santiago:
"'" + (#('three', "o'clock") -replace "'", "''" -join "', '") + "'"
The above solutions shown inside an expandable (double-quoted) PowerShell string ("..."), which requires use of $(...), the subexpression operator:
"list: $(#('three', "o'clock") -replace "'", "''" -replace '^|$', "'" -join ', ')"
# Note that the outer ' chars. can now be embedded directly in the string,
# outside $(...)
"list: '$(#('three', "o'clock") -replace "'", "''" -join "', '")'"