Solved

Anything wrong with dynamic SQL in stored proc?

Posted on 2012-03-31
4
262 Views
Last Modified: 2012-06-27
I have a co-worker who says dynamic sql shouldn't be used in stored procs because it defeats the purpose of using SQL. He says it doesnt make sense. He says the dynamic sql should be build in code (C#/ASP.Net in this case) and just run it in the code...


I dont see an issue with using dynamic sqls in stored procs. Any pros/cons?
0
Comment
Question by:Camillia
  • 2
4 Comments
 
LVL 5

Expert Comment

by:Rainverse
ID: 37792129
I don't think it really matters from a performance point of view. Neither is compiled or checked for errors until execution. From a security point of view neither should be used without validating the input against SQL injection.

-MJC
0
 
LVL 38

Assisted Solution

by:Aaron Tomosky
Aaron Tomosky earned 250 total points
ID: 37792210
It really depends on the situation. I have dynamic SQL in astored proc to basically denormalize a table just so I can look at it. But we don't ever use it from a real application because it's easy to do in c#.

The main reason for dynamic SQL is because you make the column names on the fly. Which means you have to select * which is all generally considered a nono. One reason is because if the table gets a column added it can break you whole app.

Additionally I don't know when I'd use dynamic SQL OUT of a stored proc. so really we are talking about dynamic SQL in general.
0
 
LVL 7

Author Comment

by:Camillia
ID: 37792289
>>From a security point of view neither should be used without validating the input against SQL injection.

do you have an example?
0
 
LVL 5

Accepted Solution

by:
Rainverse earned 250 total points
ID: 37793424
Have a look at this page. It pretty much covers it all: http://msdn.microsoft.com/en-us/library/ff648339.aspx
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There are some very powerful Data Management Views (DMV's) introduced with SQL 2005. The two in particular that we are going to discuss are sys.dm_db_index_usage_stats and sys.dm_db_index_operational_stats.   Recently, I was involved in a discu…
I am showing a way to read/import the excel data in table using SQL server 2005... Suppose there is an Excel file "Book1" at location "C:\temp" with column "First Name" and "Last Name". Now to import this Excel data into the table, we will use…
This Micro Tutorial will give you a basic overview how to record your screen with Microsoft Expression Encoder. This program is still free and open for the public to download. This will be demonstrated using Microsoft Expression Encoder 4.
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question