Discussion on:
View:
Show:
I wrote a custom SQL Interface class to allow for dynamically created queries on Ajax applications (PHP). It's excellent for situations such as this, and doesn't rely on SQL Procedures to do the work. I verify data in the current script, then send it to overloaded functions which also (by default at least) clean strings and arrays to prevent nasty SQL injections. I think it provides alot more feature-rich query creation (via method overloading and SQL statement creation) and removes alot of security risks involved with dynamic SQL in SQL Procedures. What do other people think of this?
That sounds interesting. I like the approach of not using T/SQL better. Can you post your script?
It sounds neat to me.
By the way, whether you write it in VB, C++, C#, or whatever, SQL is SQL. I guess you mean you like the idea of not writing it in stored procedures better?
By the way, whether you write it in VB, C++, C#, or whatever, SQL is SQL. I guess you mean you like the idea of not writing it in stored procedures better?
it seems to me that the bread and butter of products like RS and SSIS is metadata. Dynamic SQL seems to hide a lot of the things a metadata based product might need at design time. I am a big fan of dynamic sql because every so often a really good reason for using it comes up. Therefore, I'd like to recommend that readers of this article consider how using dynamic sql might eventually force their hand into the use of temp tables, table variables or a trick I just learned of (havent tried it) where a select where 1=0 approach is used to pretend that the query results will be coming from a temp table or table var, when in fact they're really going to come from dynamic sql.
reason to pu it in product level code and building a where clause would not be it.
It comes into it's own for admin scripts though.
Like rolling through a query from sysdatabases and running dbcc on them and such.
It comes into it's own for admin scripts though.
Like rolling through a query from sysdatabases and running dbcc on them and such.
I agree...it was more of an "how to do this" than a "you should do this".
Also, for your example, I imagine you could use sp_msforeachdb for something like that...
Tim
Also, for your example, I imagine you could use sp_msforeachdb for something like that...
Tim
I don't need my trusty cursor on sysdatabases anymore?
I ought to keep up to date really.
Hmmm you find away of doing things, it works damn fine, some clever arse goes and spoils it and makes you look bad.
I shall have to look that up now, or perhaps more grist for your mill?
I ought to keep up to date really.
Hmmm you find away of doing things, it works damn fine, some clever arse goes and spoils it and makes you look bad.
I shall have to look that up now, or perhaps more grist for your mill?
- Keyboard Shortcuts:
- Prev
- Next
- Toggle
