开发者

Choose a SQL table-valued function dynamically at runtime?

开发者_开发问答

I'll preface this with that I've recommended we instead look at some sort of reporting software that is outside the application, but, time being limited as is, I'm at my current question.

I'm building a function and would like to use parameter setting. How do I avoid the following?

//extremely dangerous
var queryString = "Select * from dbo." + functionName + "(:startDate, :endDate)";
var result = GetANHibernateSession().CreateSQLQuery(queryString)
                 .SetDateTime("startDate", startDate)
                 .SetDateTime("endDate", endDate);

The functions can come & go at runtime, meaning that I cannot build the queries at compile time.

EDIT: I should also point out that the functionName is not coming from an untrusted source, but within the database itself with no external facing insertion mechanism. This is only a small bit of security though.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜