Level Extreme platform
Subscription
Corporate profile
Products & Services
Support
Legal
Français
Create INSERT expression
Message
 
General information
Forum:
Microsoft SQL Server
Category:
Other
Environment versions
SQL Server:
SQL Server 2005
Miscellaneous
Thread ID:
01544913
Message ID:
01544922
Views:
22
>Hi,
>
>In a stored procedure I have a hard coded Insert expression:
>
>insert into mytable (col1, col2, col3) values (@Val4Col1, @Val4Col2, @Val4Col3)
>
>
>Since the list of columns and values has to be built dynamically, I need to be able to create
>this expression based on variables. E.g.
>
>declare @FieldNames as varchar(max)
>set @FieldNames = 'col1, col2, col3'
>-- and I can't even figure how to concatinate the list of values into a variable
>
>
>So, is it possible to create a variable for list of values and then combine it with the variable for the list of columns and
>execute the INSERT? TIA.

I agree with Sergey - introducing dynamic SQL into stored procedure means something is wrong in the architetcture. It can be done using dynamic SQL, but if done incorrectly it is a subject for SQL injection attacks. You may want to re-think your approach.
If it's not broken, fix it until it is.


My Blog
Previous
Reply
Map
View

Click here to load this message in the networking platform