Home Forums SQL Server 2008 T-SQL (SS2K8) sp_executesql dynamic columns in select statement RE: sp_executesql dynamic columns in select statement

  • November 23, 2010 at 8:43 am

    #1254512

    The sp_executesql procedure works like a dynamic SP so you can only pass values, and not object names, as parameters.

    To guard against SQL injection you can validate column names against INFORMATION_SCHEMA.COLUMNS and table names against INFORMATION_SCHEMA.TABLES.