ansaurus

Question

SQL going nuts! does not accept parameters, ?

Answer 1

+2 A:

I'm not to familiar with MS-SQL, but I don't think that parameter markers like this

SELECT @pthis FROM @tables

work.

Parameters are normally be used instead of literal values, not instead of identifiers.

inflagranti 2010-06-22 10:17:32

That's correct.

Locksfree 2010-06-22 10:21:31

"literal values, not instead of identifiers." okay, will you please describe what you mean by literal and identifiers, its a querry, where does this term come in. donot understand

2010-06-22 10:23:02

@user287745 He means you can't put a table name in a variable and run the query. SQL won't let you.

Meff 2010-06-22 10:29:38

yes i understand that, thanks

2010-06-22 10:42:44

Answer 2

+6 A:

SQL Server will definately not allow the use of a variable as a table name. As for your column name variable, it will return the number of results that the table has, but it will output TABLE_SCHEMA.

Ardman 2010-06-22 10:22:25

well i need a wa to get around it and also to use the parameters method to aviod injection, so please guide. and why would it display number of results!, i am asking it to select table_schema!

2010-06-22 10:28:33

You are creating a new column when you use a variable, this is why it returns all of the results from the table. Try it yourself:DECLARE @table AS VARCHAR(20);SET @table = 'TABLE_SCHEMA';SELECT * FROM INFORMATION_SCHEMA.TABLES;

Ardman 2010-06-22 10:34:50

o, so the above is not possible, what do you answerers... suggest i should do, i dont want to cancatenate string and variable as that will not allow me to check/enforce the data type. i have to provide the user the option with which table do you want to select and also save coding

2010-06-22 10:39:04

Not a great solution, but you could do it by building up the SQL string as you were before.

Ardman 2010-06-22 10:48:11

okay, please suggest a good solution. thanks

2010-06-22 11:54:42

One way could be to have a const set of all the variations of the SELECT command that can be done, then use a SWITCH statement in your code to choose the correct statement.

Ardman 2010-06-22 12:27:16

ansaurus

tags:

views:

answers:

SQL going nuts! does not accept parameters, ?

related questions