stored procedures - Create table by passing name as early defined and value assigned variable in SQL Server 2012 -


this question has answer here:

i trying create stored procedure create table below:

create procedure tablecreation     declare @tablename nvarchar(30)     set @tablename = 'employee'     begin          create table @tablename (             id int not null         )     end 

but when execute procedure, error:

msg 102, level 15, state 1, procedure tablecreation, line 7
incorrect syntax near '@tablename'.

what issue above procedure or there other way achieve above task?

this might help, starters:

create procedure tablecreation     declare @tablename nvarchar(30)     set @tablename = 'employee' begin      declare @sql nvarchar(max)      set @sql = 'create table ' + @tablename + '( id int not null )';      exec sp_executesql @sql  end 

but there better (but still not ideal) ways of using dynamic sql, example parametrizing query decrease changes of code being prone sql injection. check out 1 of established articles on topic.

but, if not pass table name parameter procedure, guess you're safe sql injection (although kind of obscure , strange behaviour).


Comments

Popular posts from this blog

php - Wordpress website dashboard page or post editor content is not showing but front end data is showing properly -

How to get the ip address of VM and use it to configure SSH connection dynamically in Ansible -

javascript - Get parameter of GET request -