views:

1393

answers:

2

I have to convert an MSSQL stored proc that passes a varchar that is a query. The proc has the following command:

INSERT INTO Results
  EXEC (@Expresion);

This isn't working. I'm pretty sure that EXEC and EXECUTE arent MySQL commands but CALL doesn't work either. Does anyone know if its even possible to have something like JavaScript's eval function for mysql?

Thanks

From the link in bodnarbm's post I got this solution:

SET @s = CONCAT('INSERT INTO Results ', @Expression);
PREPARE stmt FROM @s;
EXECUTE stmt;
+1  A: 

EXECUTE is a valid command in MySQL. MySQL reference manual

Brandon Bodnár
A: 

This smacks of SQL injection. Personally, I would say this was a poor design if I saw it in a code review. It might "work", but I'd be wary.

duffymo
I agree, but this is very common place in a lot of MSSQL DBs I have had to maintain. Just to reiterate, I'm migrating software here, and not creating it.
DJTripleThreat