创建表时应该使用什么SqlDbType？

Question

I don't know if this is really needed... but I would like write as robust code as possible, so:

What SqlDbType should be used when creating a table? SqlDbType.NChar ? Or would there be a problem with a Unicode table name? Or perhaps one of the Var types because the length is unknown? I'm used to thinking about these types in the context of a database row, not table, so I'm not sure what should be used here.

EDIT

For example, a line like:

sqlCommand.Parameters.Add(new SqlParameter(parameterName,SqlDbType.NChar){ Value = value });

for a CREATE TABLE command.

Answer 1

You can't parameterize your table name or column names or any other database objects. You can only parameterize your values.

You can still using string concatenation it but getting your table name as an input is too risky in my opinion. You should either perform very stringent validation on the table name before putting it into the SQL, or have a white-listed set of valid table names, in order to avoid SQL Injection attacks.

Other than that, parameterized statements is only for DML Statements not DDL statements .

Answer 2

All object names in SQL Server are of sysname datatype. Don't know if the SqlDbType contains sysname, but it is functionally identical to nvarchar(128) , so you can use this.