Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Anything wrong with dynamic SQL in stored proc?

Posted on 2012-03-31
4
Medium Priority
?
271 Views
Last Modified: 2012-06-27
I have a co-worker who says dynamic sql shouldn't be used in stored procs because it defeats the purpose of using SQL. He says it doesnt make sense. He says the dynamic sql should be build in code (C#/ASP.Net in this case) and just run it in the code...


I dont see an issue with using dynamic sqls in stored procs. Any pros/cons?
0
Comment
Question by:Camillia
  • 2
4 Comments
 
LVL 5

Expert Comment

by:Rainverse
ID: 37792129
I don't think it really matters from a performance point of view. Neither is compiled or checked for errors until execution. From a security point of view neither should be used without validating the input against SQL injection.

-MJC
0
 
LVL 39

Assisted Solution

by:Aaron Tomosky
Aaron Tomosky earned 1000 total points
ID: 37792210
It really depends on the situation. I have dynamic SQL in astored proc to basically denormalize a table just so I can look at it. But we don't ever use it from a real application because it's easy to do in c#.

The main reason for dynamic SQL is because you make the column names on the fly. Which means you have to select * which is all generally considered a nono. One reason is because if the table gets a column added it can break you whole app.

Additionally I don't know when I'd use dynamic SQL OUT of a stored proc. so really we are talking about dynamic SQL in general.
0
 
LVL 7

Author Comment

by:Camillia
ID: 37792289
>>From a security point of view neither should be used without validating the input against SQL injection.

do you have an example?
0
 
LVL 5

Accepted Solution

by:
Rainverse earned 1000 total points
ID: 37793424
Have a look at this page. It pretty much covers it all: http://msdn.microsoft.com/en-us/library/ff648339.aspx
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, when I was asked to create a new SQL 2005 cluster, Microsoft released a new service pack for MS SQL 2005 what is Service Pack 3. When I finished the installation of MS SQL 2005 I found myself troubled why the installation of SP3 failed …
There are some very powerful Dynamic Management Views (DMV's) introduced with SQL 2005. The two in particular that we are going to discuss are sys.dm_db_index_usage_stats and sys.dm_db_index_operational_stats.   Recently, I was involved in a di…
How to fix incompatible JVM issue while installing Eclipse While installing Eclipse in windows, got one error like above and unable to proceed with the installation. This video describes how to successfully install Eclipse. How to solve incompa…
Are you ready to place your question in front of subject-matter experts for more timely responses? With the release of Priority Question, Premium Members, Team Accounts and Qualified Experts can now identify the emergent level of their issue, signal…

971 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question