Dynamic Sql Not so scary? Trevor Makoni IQ Business

What we are not going to cover. Security risks from Sql injection. Differences between sp_executesql & exec. Query optimization. 2 | 4/15/2019 |

What we are not going to cover. Security risks from Sql injection. DECLARE @Sql VARCHAR(MAX), @EmployeeID = ‘1;drop table <table>’ SET @Sql = ' SELECT [Title] + '' '' + [FirstName] + '' '' + [LastName] as Name FROM [dbo].[Employees] WITH (NOLOCK) WHERE [EmployeeID] = ' + @EmployeeID; EXEC (@Sql); 3 | 4/15/2019 |

What we are going to cover. What is dynamic Sql? Where can we use dynamic Sql? Negative myths around dynamic Sql? How to effectively use dynamic Sql as a tool. Demo 4 | 4/15/2019 |

What is dynamic Sql? Dynamic SQL is a programming technique that enables you to build SQL statements dynamically at runtime. You can create more general purpose, flexible applications by using dynamic SQL because the full text of a SQL statement may be unknown at compilation. Dynamic SQL is simply a SQL statement that is composed on the fly before being executed. 4/15/2019 |

Where can we use dynamic Sql? You should use dynamic SQL in cases where static SQL does not support the operation you want to perform, or in cases where you do not know the exact SQL statements that must be executed by a SQL procedure. These SQL statements may depend on user input, or they may depend on processing work done by the program. 4/15/2019 |

Negative myths around dynamic Sql? Dynamic SQL is very difficult to understand let alone implement! Dynamic SQL takes too long to generate, using Static SQL is more time efficient! 4/15/2019 |

How to effectively use dynamic Sql as a tool. Steps to successful use of dynamic SQL. Understand what is needed. Identity any repeatable code. Have a clear strategy and solution first. Make sure you provide annotations in code. 4/15/2019 |

How to effectively use dynamic Sql as a tool. The best way to tackle this is to get straight onto the playing field. Let us look at a situation where a need arises that requires a user to copy a database without using the import wizard or database restore. Upfront we can see that static SQL will not cut it as there are a whole lot of unknowns in this task! 4/15/2019 |

Demo Let us walk through this process step by step… What objects need to be copied? The database Schemas Tables Primary Keys Foreign Keys Default Constraints Check Constraints Indexes 4/15/2019 |

Demo What objects need to be copied? Views Stored Procedures Functions Triggers Now that we know what is needed, let us step into some code…. Dynamic Sql demo 4/15/2019 |

12 | 4/15/2019 |