stored procedures - Create table by passing name as early defined and value assigned variable in SQL Server 2012 -
this question has answer here:
- table name variable 7 answers
i trying create stored procedure create table below:
create procedure tablecreation declare @tablename nvarchar(30) set @tablename = 'employee' begin create table @tablename ( id int not null ) end
but when execute procedure, error:
msg 102, level 15, state 1, procedure tablecreation, line 7
incorrect syntax near '@tablename'.
what issue above procedure or there other way achieve above task?
this might help, starters:
create procedure tablecreation declare @tablename nvarchar(30) set @tablename = 'employee' begin declare @sql nvarchar(max) set @sql = 'create table ' + @tablename + '( id int not null )'; exec sp_executesql @sql end
but there better (but still not ideal) ways of using dynamic sql, example parametrizing query decrease changes of code being prone sql injection. check out 1 of established articles on topic.
but, if not pass table name parameter procedure, guess you're safe sql injection (although kind of obscure , strange behaviour).
Comments
Post a Comment