动态SQL的良好做法

Question

I use tons of dynamic SQL - I figured that there must some good guidelines, frameworks and/or tools to help one use dynamic SQL queries. I'm looking for any suggestions on how exactly should one compose dynamic SQL query (with out the obvious solution of simply writing it, then adding ' ' ect).

The big problem here that sometimes it gets way to messy (dynamic sql that contains another dynamic sql ect).

If it matters at all, I am using sql-server.

I'll take any advice I can get, Thanks! ;)

Answer 1

Vague question.. But one piece of advice:

Use sp_executesql and pass in any variables/parameters whenever possible to prevent SQL injection

Answer 2

If possible generate the dynamic SQL as much as possible, don't write it yourself.

Execute the dynamic SQL without appending the parameters to the SQL string, use parameters and pass those to sp_executesql to avoid having to do double quoting (too tedious). It is also a solid guard against SQL Injection. Example:

DECLARE @stmt NVARCHAR(MAX)='SELECT * FROM your_table WHERE id=@par1 AND ... AND thename=@parn;';
EXECUTE sp_executesql @stmt, N'@par1 INT, ..., @parn VARCHAR(256)', @par1, ... , @parn;