Parameterise table name in .NET/SQL?

by

You cannot directly parameterize the table name. You can do it indirectly via sp_ExecuteSQL, but you might just as well build the (parameterized) TSQL in C# (concatenating the table-name but not the other values) and send it down as a command. You get the same security model (i.e. you need explicit SELECT etc, and assuming it isn’t signed etc).

Also – be sure to white-list the table name.

More Related Contents:

  1. Parameterize an SQL IN clause
  2. Fastest way to perform nested bulk inserts with scope_identity() usage?
  3. How to set table name in dynamic SQL query?
  4. Pass table as parameter into sql server UDF
  5. Can we pass parameters to a view in SQL?
  6. “Order By” using a parameter for the column name
  7. Call stored procedure with table-valued parameter from java
  8. SQL QUERY COUNT THEN ADD
  9. SQL server command help and tutorials for specific commands?
  10. How do I UPDATE from a SELECT in SQL Server?
  11. How to return only the Date from a SQL Server DateTime datatype
  12. Referring to a Column Alias in a WHERE Clause
  13. Convert Datetime column from UTC to local time in select statement
  14. How to implement LIMIT with SQL Server? [duplicate]
  15. converting Epoch timestamp to sql server(human readable format)
  16. What are Covering Indexes and Covered Queries in SQL Server?
  17. What’s the best way to select the minimum value from several columns?
  18. Add a summary row with totals
  19. Counting DISTINCT over multiple columns
  20. How to check if a stored procedure exists before creating it
  21. Calculate business hours between two dates
  22. Correct use of transactions in SQL Server
  23. SSIS Source Format Implicit Conversion for Datetime
  24. store arabic in SQL database
  25. Lightweight SQL database which doesn’t require installation [closed]
  26. how does SELECT TOP works when no order by is specified?
  27. Compare dates in T-SQL, ignoring the time part
  28. Safest way to get last record ID from a table
  29. Space used by nulls in database
  30. Removing duplicate rows (based on values from multiple columns) from SQL table

Leave a Comment