mysql动态拼接sql语句

begin

/**procedure body**/
if(m_parameter='') then
set @sqlStr=concat('select id,title,description,msg,logo,notice,views,grade,commenttimes from kmb01',' order by ',m_sort,' ',m_sortType,' limit ',m_index,',',m_length);
else
set @sqlStr=concat('select id,title,description,msg,logo,notice,views,grade,commenttimes from kmb01 where ',m_parameter,' order by ',m_sort,' ',m_sortType,' limit ',m_index,',',m_length);
end if;
PREPARE msql from @sqlStr;
EXECUTE msql;
end