Dynamic query

Dynamic query

• DinaD

  Hi Dato0011,

  It seems that some weird bug deleted the formatting of my reply. Let's do that one more time, shall we

  On Sat, 21 Jan 2006 11:30:01 -0800, <Dato0011@discussions.microsoft.com>
  wrote:

  >I'm a newbie in sql server. anyone can explain what does Dynamic query
  >means

  Hi Dato0011,

  Dynamic SQL means that the query is not precoded in a stored procedure
  or application, but created on the spot. Example of non-dynamic SQL:

  SELECT COUNT(*) FROM pubs..authors

  Example of dynamic SQL:

  DECLARE @SQL nvarchar(400)
  SET @SQL = 'SELECT COUNT(*) FROM pubs..authors'
  EXECUTE (@SQL)

  (In a real situation, part of the dynamic SQL would be based on user
  input).

  Dynamic SQL can be advantegeous in some situations, but it is also
  extremely dangerous. Using dynamic SQL requires permissions for the end
  users on your tables, and -the most important danger!- exposes your DB
  to the danger of SQL injection.

  For a completediscussion of the curse and blessing of dynamic SQL, see
  Erland Sommarskog's article:
  http://www.sommarskog.se/dynamic_sql.html

  --
  Hugo Kornelis, SQL Server MVP

  
  

• tuzojazz

  Sure, but for some basic understandings (perhaps your questions will be cleared after the detailed the explanation of this text) look for:
  
  http://www.sommarskog.se/dynamic_sql.html
  
  HTH, jens Suessmeyer.

  
  

• mrdenny

  On Sat, 21 Jan 2006 11:30:01 -0800, wrote: >I'm a newbie in sql server. anyone can explain what does Dynamic query >means Hi Dato0011, Dynamic SQL means that the query is not precoded in a stored procedure or application, but created on the spot. Example of non-dynamic SQL: SELECT COUNT(*) FROM pubs..authors Example of dynamic SQL: DECLARE @SQL nvarchar(400) SET @SQL = 'SELECT COUNT(*) FROM pubs..authors' EXECUTE (@SQL) (In a real situation, part of the dynamic SQL would be based on user input). Dynamic SQL can be advantegeous in some situations, but it is also extremely dangerous. Using dynamic SQL requires permissions for the end users on your tables, and -the most important danger!- exposes your DB to the danger of SQL injection. For a completediscussion of the curse and blessing of dynamic SQL, see Erland Sommarskog's article: http://www.sommarskog.se/dynamic_sql.html -- Hugo Kornelis, SQL Server MVP
  
• Dynamic query