This page has 0 threads | Add post

Blogs

Finding our blogs useful? Please consider helping us to share more!

Dynamic SQL Part one of a four-part series of blogs
Dynamic SQL is a technique for building valid SQL statements from separate pieces of text. You can use this technique to create remarkably flexible and useful queries, as long as you're aware of the potential danger of SQL injection attacks. Dynamic SQL (this blog) Concatenation in SQL Building Dynamic SQL Statements SQL Injection Attacks This blog is part of our complete SQL tutorial. You can also learn about this technique from our SQL training courses.

Dynamic SQL

Part one of a four-part series of blogs

Dynamic SQL is a technique for building valid SQL statements from separate pieces of text. You can use this technique to create remarkably flexible and useful queries, as long as you're aware of the potential danger of SQL injection attacks.

This blog is part of our complete SQL tutorial. You can also learn about this technique from our SQL training courses.

Posted by Andrew Gould on 22 April 2013

Dynamic SQL

Using dynamic SQL allows you to construct a string of text which can then be executed as an SQL statement. There are several reasons why this can be useful and one reason why it's potentially dangerous.

Executing a Basic String of Text

You can execute a string of text as an SQL statement by using the EXECUTE or EXEC keywords:

EXEC ('SELECT * FROM tblFilm')

Executing the code above provides the same results as the SELECT statement would have generated by itself.

Using a System Stored Procedure to Execute a String

You can also use a system stored procedure called sp_executesql to execute a string as a statement:

EXEC sp_executesql N'SELECT * FROM tblFilm'

Again, the results of executing this code are the same as those that would be generated by the SELECT statement itself.

When using the sp_executesql stored procedure you must make sure to pass the text as a unicode string. Hence the letter N which precedes the string in the example above.

What's the Difference?

The main difference between the two methods described above is that the sp_executesql stored procedure enables the use of query plan caching. In simple terms this means that using the stored procedure can result in dynamic SQL which runs faster than simply using the EXEC statement alone.

What's the Point?

So why is any of this useful? Well, the power in dynamic SQL comes from the fact that you can build any SQL statement you want by concatenating strings of text. This means that any part of a statement can be set using variables or parameters. The next part of this blog series explains how concatenation works in SQL Server.

Parts of this blog
Dynamic SQL (this blog) Concatenation in SQL Building Dynamic SQL Statements SQL Injection Attacks

Some other pages relevant to the above blogs include:

This blog has 0 threads

Add a new post

Head office

Kingsmoor House

Railway Street

GLOSSOP

SK13 2AA

London

Landmark Offices

99 Bishopsgate

LONDON

EC2M 3XD

Manchester

Holiday Inn

25 Aytoun Street

MANCHESTER

M1 3AE

Site map

Terms & Conditions

Book any course as classroom, onsite or online training, or as one-to-one consultancy

Free resources

Paid services

Getting help

Where we are

Where you are

Online

Transparent reviews

Delivery of courses

Nicer to work with

Reliable and established

Our training courses

C#

Excel

MySQL

Power Apps

Power Automate

Power BI and DAX

Python

Report Builder

SQL

SQL Server

VBA Macros

Other training resources

Blogs

Exercises

YouTube tutorials

YouTube shorts

Test your skills

Consultancy

Courseware

Self-paced courses

Newsletters

Publications

Our training venues

London

Manchester

Across the UK

At your site

Online

Why we are different

Hundreds of published reviews

Small class sizes

Outstanding courseware

Online classroom

(Almost) no cancellations

Wise Owl trainers only

Genuine integrity

Invoices after training

30+ years of Wise Owl

Our top 100 clients

BLOGS BY TOPIC

BLOGS BY AUTHOR

Dynamic SQL

Executing a Basic String of Text

Using a System Stored Procedure to Execute a String

What's the Difference?

What's the Point?

Head office

London

Manchester