Stored procedure

Hi every body

when i ran this code in sql server 2005

"use test

go

create proc testProc @s nvarchar(100),

@t nvarchar(100)

As

begin

select @s from @t

end

go"

i encountered this error message

"Incorrect syntax near '@t'."

what is wrong in my code

by thanks

Javaneh

Answer this question

Stored procedure

-Codeman-
so thanks friends

I'll try them

thanks again for your guidances
Mike Husar

This particular example doesn't protect against SQL injection attack. So you need to be very careful using such approaches. And as far as possible use sp_executesql instead of EXEC since it gives parameterization capability and better plan caching/reuse. Additionally for object names that you take as input from end user you should use QUOTENAME to protect against injection attacks before forming the SELECT string. So in example above you would do:

declare @tbl nvarchar(200), @sql nvarchar(4000)

set @tbl = quotename(@t)

set @sql = N'select x from ' + @tbl

exec sp_executesql @sql
MarksmanWaugh
Hi Roji

so thanks for your help

I got it
Paulaps

Well, you gotta read

http://www.sommarskog.se/dynamic_sql.html
ramexx
Hi

You need to constract a string that can be executed by EXEC . Replace your

select @s from @t

with

EXEC ('select ' + @s + ' from ' + @t )

NB.
Stored procedure

Answer this question