Dynamic SQL Konstantin Osipov, MySQL AB

About the speaker lives in Moscow works on the server implemented the feature

What is this talk about? how Dynamic SQL works good practices getting your feedback

Dynamic SQL syntax is syntax of SQL prepared statements: PREPARE <name> FROM <text> EXECUTE <name> USING <@-var list> DEALLOCATE PREPARE <name>

Degree of Freedom Static SQL: @-user variables to input data Stored Procedures SQL: stored procedure variables Prepared SQL: adds LIMIT ?, ? capability Dynamic SQL: 100% flexibility

Permissions, Scope Permissions: are the same as of the Stored Procedure dangerous in SUID procedures Scope: Dynamic SQL has its own scope no access to SP variables temporary tables are in the scope of SP

How it works

Dynamic SQL Dos administrative tasks CHECK, OPTIMIZE dynamic querying IN (id-list), handling of hierarchical data

Dynamic SQL Dont's don't use it if you don't have to: risk of SQL injection it does not provide extra optimization Static SQL is re-optimized just as well it allows the same statements as in Stored Procedures

Dynamic SQL Limits not all statements three step procedure: no EXECUTE IMMEDIATE no cursor support no access to Stored Procedure variables Stored Procedure variables can't be bound to placeholders can't be used in Functions and Triggers

Questions?