Choose a SQL table-valued function dynamically at runtime?
I'll preface this with that I've recommended we instead look at some sort of reporting software that is outside the application, but, time being limited as is, I'm at my current question.
I'm building a function and would like to use parameter setting. How do I avoid the following?
//extremely dangerous
var queryString = "Select * from dbo." + functionName + "(:startDate, :endDate)";
var result = GetANHibernateSession().CreateSQLQuery(queryString)
.SetDateTime("startDate", startDate)
.SetDateTime("endDate", endDate);
The functions can come & go at runtime, meaning that I cannot build the queries at compile time.
EDIT: I should also point out that the functionName is not coming from an untrusted source, but within the database itself with no external facing insertion mechanism. This is only a small bit of security though.
精彩评论