Click here to Skip to main content
15,890,282 members
Home / Discussions / Database
   

Database

 
GeneralRe: sp_who2 Pin
kubben8-Mar-07 14:43
kubben8-Mar-07 14:43 
Questionplease i need help Pin
Mr.Kode8-Mar-07 13:33
Mr.Kode8-Mar-07 13:33 
AnswerRe: please i need help Pin
N a v a n e e t h8-Mar-07 20:18
N a v a n e e t h8-Mar-07 20:18 
Questionsplitting data using sql Pin
Kunal P8-Mar-07 5:03
Kunal P8-Mar-07 5:03 
AnswerRe: splitting data using sql Pin
Marcus J. Smith8-Mar-07 5:44
professionalMarcus J. Smith8-Mar-07 5:44 
QuestionRe: splitting data using sql Pin
Kunal P8-Mar-07 6:00
Kunal P8-Mar-07 6:00 
QuestionDynamic SQL Statements in Stored Procedure Pin
N a v a n e e t h8-Mar-07 3:01
N a v a n e e t h8-Mar-07 3:01 
AnswerRe: Dynamic SQL Statements in Stored Procedure Pin
Colin Angus Mackay8-Mar-07 3:27
Colin Angus Mackay8-Mar-07 3:27 
Navaneethkn wrote:
What is your opinion about writing dynamic SQL statements in stored procedure ?


Don't use them unless you have to, and if you have to use them be very careful as dynamic SQL has some seriously bad consequences for security if used badly.

Take a look at SQL Injection Attacks and Tips on How to Prevent them[^]

Navaneethkn wrote:
Set @SQL = 'select * from table'
Exec (@SQL)

is it a good practice ?


For something as simple as that, no.

If you didn't know the name of the table in advance, then okay - but you should check that the table actually exists prior to building the dynamic sql and ensure that the table name is wrapped in square brackets: [LikeThis]


Upcoming events:
* Edinburgh: Web Security Conference Day for Windows Developers (12th April)
* Glasgow: AJAX, SQL Server, Mock Objects


My: Website | Blog | Photos

GeneralRe: Dynamic SQL Statements in Stored Procedure Pin
Frank Kerrigan8-Mar-07 11:55
Frank Kerrigan8-Mar-07 11:55 
GeneralRe: Dynamic SQL Statements in Stored Procedure Pin
Colin Angus Mackay8-Mar-07 11:57
Colin Angus Mackay8-Mar-07 11:57 
GeneralRe: Dynamic SQL Statements in Stored Procedure Pin
N a v a n e e t h8-Mar-07 20:09
N a v a n e e t h8-Mar-07 20:09 
GeneralRe: Dynamic SQL Statements in Stored Procedure Pin
Colin Angus Mackay8-Mar-07 21:26
Colin Angus Mackay8-Mar-07 21:26 
QuestionDateTime Problem Pin
sks838-Mar-07 2:50
sks838-Mar-07 2:50 
AnswerRe: DateTime Problem Pin
N a v a n e e t h8-Mar-07 3:04
N a v a n e e t h8-Mar-07 3:04 
AnswerRe: DateTime Problem Pin
Hayder Marzouk8-Mar-07 21:56
Hayder Marzouk8-Mar-07 21:56 
QuestionClient - Server Pin
alav8-Mar-07 1:56
alav8-Mar-07 1:56 
AnswerRe: Client - Server Pin
Pete O'Hanlon8-Mar-07 2:06
mvePete O'Hanlon8-Mar-07 2:06 
QuestionPIVOT in SQL 2005 problem Pin
Håkan Nilsson (k)8-Mar-07 0:20
Håkan Nilsson (k)8-Mar-07 0:20 
Questionoleobject in sql oracle mysql Pin
nikhil12347-Mar-07 22:35
nikhil12347-Mar-07 22:35 
AnswerRe: oleobject in sql oracle mysql Pin
Colin Angus Mackay8-Mar-07 0:08
Colin Angus Mackay8-Mar-07 0:08 
QuestionRegarding Video files Pin
praveen_gattu20007-Mar-07 21:22
praveen_gattu20007-Mar-07 21:22 
AnswerRe: Regarding Video files Pin
Paddy Boyd8-Mar-07 0:00
Paddy Boyd8-Mar-07 0:00 
AnswerRe: Insert Problem Pin
_anil_7-Mar-07 21:02
_anil_7-Mar-07 21:02 
GeneralRe: Insert Problem Pin
Colin Angus Mackay8-Mar-07 0:10
Colin Angus Mackay8-Mar-07 0:10 
Questionproblem on on date filtering Pin
firestoper7-Mar-07 19:45
firestoper7-Mar-07 19:45 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.