Dynamic sql

[Robbie]

When executing dynamic sql, how can you avoid issues if delimiters are in
the data ?

Assume I have a list box in an applicaion with the following values....

ABC
3'
879
Plus many more they may select...

If I do something like.... where Item = 'ABC'or Item='3'' or Item ='879'

I've got a problem... how might I avoid this ?

[Erland Sommarskog]

Robbie (ro...@yahoo.com) writes:
> When executing dynamic sql, how can you avoid issues if delimiters are in
> the data ?

You use sp_executesql and parameters.

I have a longer article on my web site which discusses dynamic SQL in
detail, including use of sp_executesql:
http://www.sommarskog.se/dynamic_sql.html.

--
Erland Sommarskog, SQL Server MVP, esq...@sommarskog.se

Links for SQL Server Books Online:
SQL 2008: http://msdn.microsoft.com/en-us/sqlserver/cc514207.aspx
SQL 2005: http://msdn.microsoft.com/en-us/sqlserver/bb895970.aspx
SQL 2000: http://www.microsoft.com/sql/prodinfo/previousversions/books.mspx