Solved

Anything wrong with dynamic SQL in stored proc?

Posted on 2012-03-31
4
264 Views
Last Modified: 2012-06-27
I have a co-worker who says dynamic sql shouldn't be used in stored procs because it defeats the purpose of using SQL. He says it doesnt make sense. He says the dynamic sql should be build in code (C#/ASP.Net in this case) and just run it in the code...


I dont see an issue with using dynamic sqls in stored procs. Any pros/cons?
0
Comment
Question by:Camillia
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 5

Expert Comment

by:Rainverse
ID: 37792129
I don't think it really matters from a performance point of view. Neither is compiled or checked for errors until execution. From a security point of view neither should be used without validating the input against SQL injection.

-MJC
0
 
LVL 39

Assisted Solution

by:Aaron Tomosky
Aaron Tomosky earned 250 total points
ID: 37792210
It really depends on the situation. I have dynamic SQL in astored proc to basically denormalize a table just so I can look at it. But we don't ever use it from a real application because it's easy to do in c#.

The main reason for dynamic SQL is because you make the column names on the fly. Which means you have to select * which is all generally considered a nono. One reason is because if the table gets a column added it can break you whole app.

Additionally I don't know when I'd use dynamic SQL OUT of a stored proc. so really we are talking about dynamic SQL in general.
0
 
LVL 7

Author Comment

by:Camillia
ID: 37792289
>>From a security point of view neither should be used without validating the input against SQL injection.

do you have an example?
0
 
LVL 5

Accepted Solution

by:
Rainverse earned 250 total points
ID: 37793424
Have a look at this page. It pretty much covers it all: http://msdn.microsoft.com/en-us/library/ff648339.aspx
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

There are some very powerful Data Management Views (DMV's) introduced with SQL 2005. The two in particular that we are going to discuss are sys.dm_db_index_usage_stats and sys.dm_db_index_operational_stats.   Recently, I was involved in a discu…
In this article we will get to know that how can we recover deleted data if it happens accidently. We really can recover deleted rows if we know the time when data is deleted by using the transaction log.
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question