Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Anything wrong with dynamic SQL in stored proc?

Posted on 2012-03-31
4
Medium Priority
?
274 Views
Last Modified: 2012-06-27
I have a co-worker who says dynamic sql shouldn't be used in stored procs because it defeats the purpose of using SQL. He says it doesnt make sense. He says the dynamic sql should be build in code (C#/ASP.Net in this case) and just run it in the code...


I dont see an issue with using dynamic sqls in stored procs. Any pros/cons?
0
Comment
Question by:Camillia
  • 2
4 Comments
 
LVL 5

Expert Comment

by:Rainverse
ID: 37792129
I don't think it really matters from a performance point of view. Neither is compiled or checked for errors until execution. From a security point of view neither should be used without validating the input against SQL injection.

-MJC
0
 
LVL 39

Assisted Solution

by:Aaron Tomosky
Aaron Tomosky earned 1000 total points
ID: 37792210
It really depends on the situation. I have dynamic SQL in astored proc to basically denormalize a table just so I can look at it. But we don't ever use it from a real application because it's easy to do in c#.

The main reason for dynamic SQL is because you make the column names on the fly. Which means you have to select * which is all generally considered a nono. One reason is because if the table gets a column added it can break you whole app.

Additionally I don't know when I'd use dynamic SQL OUT of a stored proc. so really we are talking about dynamic SQL in general.
0
 
LVL 7

Author Comment

by:Camillia
ID: 37792289
>>From a security point of view neither should be used without validating the input against SQL injection.

do you have an example?
0
 
LVL 5

Accepted Solution

by:
Rainverse earned 1000 total points
ID: 37793424
Have a look at this page. It pretty much covers it all: http://msdn.microsoft.com/en-us/library/ff648339.aspx
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

by Mark Wills PIVOT is a great facility and solves many an EAV (Entity - Attribute - Value) type transformation where we need the information held as data within a column to become columns in their own right. Now, in some cases that is relatively…
In this article I will describe the Copy Database Wizard method as one possible migration process and I will add the extra tasks needed for an upgrade when and where is applied so it will cover all.
As many of you are aware about Scanpst.exe utility which is owned by Microsoft itself to repair inaccessible or damaged PST files, but the question is do you really think Scanpst.exe is capable to repair all sorts of PST related corruption issues?
The Relationships Diagram is a good way to get an overall view of what a database is keeping track of. It is also where relationships are defined. A relationship specifies how two tables connect to each other. As you build tables in Microsoft Ac…

578 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question