I have a Stored Procedure to get the details of Invoices

Some occasions I get the list of invoices by sending only the InvoiceID 
But in some other occasions I need to get the list of invoices as per the search fields supplied by the user. To do this I send all the fields to the Stored Procedure and use those parameters as below. I included only 2 columns but there are more.

```
SELECT * FROM INVOICES I
    WHERE 
    (@InvoiceNumber is null or  I.InvoiceNumber =  @InvoiceNumber)
    and
    (@PONo is null or I.PONo = @PONo)

```

Is there a way to send the condition for the WHERE clause as one parameter?
['https://Stackoverflow.com/questions/36834939', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/4073943/']
Yes, it is possible with Dynamic SQL, but I highly discourage to do that.

[SELECT \* FROM tbl WHERE @condition](http://www.sommarskog.se/dynamic_sql.html#Condition):

> 
> If you are considering to write the procedure
> 
> 
> 
> ```
> CREATE PROCEDURE search_sp @condition varchar(8000) AS
>    SELECT * FROM tbl WHERE @condition
> 
> ```
> 
> **Just forget it. If you are doing this, you have not completed the transition to use stored procedure and you are still assembling your
>  SQL code in the client.**
> 
> 
> 

It will also open your application to SQL Injection attacks.
You can use custom type to pass table as parameter <https://msdn.microsoft.com/pl-pl/library/bb510489(v=sql.110).aspx> or you can use default parameters