We're thinking of storing SQL queries in a separate table. These queries are solely for reporting purposes. Different queries for different reports - moreover the queries would contain placeholders so we can either format or use prepared statements from the Winforms front end (it's a simple 2-tier reporting app) to e.g. format the date range to report on.
I'm having some mixed feelings about that - is it ok to store SQL in a table, that clients will fetch and run?
I agree with Gregoire -- Store procedures are a good way forward, if your language works well with them.
Otherwise, ask:
What's the difference between storing them in source, XML files, SQL etc. Storage is storage is storage ... the potential damage of misuse and implementing without considering the constraints in relation to your app is what counts.
In my opinion that looks like a quick and dirty solution. What if in the future you wanted to migrate to another DB engine with a different SQL dialect? A better solution is to create a report object model (or xml model) and map it to a corresponding DB schema. This requires more time and effort though.