How To Parameterize SQL Table Names

preview_player
Показать описание
Do you know how to safely pass in a table name or column name parameter value into your dynamic SQL query?

sp_executesql won't allow you to parameterize SQL object names. You have to revert back to building dynamic SQL and appending those parameter values to your SQL string.

In this video we examine how to do so safely without opening yourself up to SQL injection attacks.

Links below.

Blog post with example queries:

Follow me on Twitter:

Рекомендации по теме
Комментарии
Автор

The way this has to be done feels like all the things database classes tell you not to do :(

DaniLearnsIT