September 18, 2008 at 12:56 am
Hi,
I have got the situation to add column name dynamically with the data type of int. I have tried to create Stored Procedure with the column name as parameter. My query as follows
Declare @ColumnName as Varchar(50)
Set @ColumnName ='column1'
Alter table shalinitest Add @ColumnName int
I got the following error
Incorrect syntax near '@ColumnName'.
I don't know whether i m moving in a right path. Could anyone Help me
September 18, 2008 at 1:45 am
Hi,
I have tried with the modified query as follows
Declare @ColumnName as Varchar(50)
declare @ssql nvarchar(200)
Set @ColumnName ='Column1'
set @ssql = 'Alter table shalinitestAdd ' + @ColumnName + ' int'
But the column is not added in my table
September 18, 2008 at 1:54 am
Hi,
I m sorry. I have missed sp_executesql . Thanks. Working fine
September 18, 2008 at 2:10 am
shalini_pdi (9/18/2008)
Hi,I m sorry. I have missed sp_executesql . Thanks. Working fine
Is It Possible to pass the data type dynamically
September 18, 2008 at 2:18 am
shalini_pdi (9/18/2008)
shalini_pdi (9/18/2008)
Hi,I m sorry. I have missed sp_executesql . Thanks. Working fine
Is It Possible to pass the data type dynamically
Why do you need all in Dynamic sql?
Anyway, make sure to read this atricle fully
http://www.sommarskog.se/dynamic_sql.html
Failing to plan is Planning to fail
September 18, 2008 at 3:35 am
Wandrag (9/18/2008)
Yip - just replace the "int" with a variable wich you populate with the datatype you want...ex.
DECLARE @DataType nVarchar(32)
set @DataType = ' Bigint'
Hi
I have tried With the following code as
Declare @ColumnName as Varchar(50)
declare @ssql nvarchar(200)
declare @dataType nvarchar(150)
Set @ColumnName ='Column1'
Set @dataType ='nvarchar(50)'
set @ssql = 'Alter table Emp Add '+ @ColumnName @dataType
exec sp_executesql @ssql
But i got error as follows
Incorrect syntax near '@dataType'
October 6, 2018 at 11:08 pm
Declare @ColumnName as Varchar(50)
declare @ssql nvarchar(200)
declare @dataType nvarchar(150)
Set @ColumnName ='Column1'
Set @dataType ='nvarchar(50)'
set @ssql = 'Alter table Emp Add '+ @ColumnName+' '+ @dataType
print @ssql
exec sp_executesql @ssql
it works.
October 7, 2018 at 11:20 am
135heidari - Saturday, October 6, 2018 11:08 PMDeclare @ColumnName as Varchar(50)
declare @ssql nvarchar(200)
declare @dataType nvarchar(150)Set @ColumnName ='Column1'
Set @dataType ='nvarchar(50)'
set @ssql = 'Alter table Emp Add '+ @ColumnName+' '+ @dataTypeprint @ssql
exec sp_executesql @ssqlit works.
Even after 10 years, so will the SQL Injection that can hit this, especially if the column name comes from something that is public facing.
I'll also state that the OP never posted the reasoning behind doing this, which is usually a faulty reason to begin with.
--Jeff Moden
Change is inevitable... Change for the better is not.
Viewing 8 posts - 1 through 8 (of 8 total)
You must be logged in to reply to this topic. Login to reply
This website stores cookies on your computer.
These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media.
To find out more about the cookies we use, see our Privacy Policy