Ok, I'm trying to write a query in a stored procedure in SQL Server 2000. Because some of the parts of the query vary based on certain situations I construct a string that contains the query and ...

Dynamic SQL lets you create a query string based off of user input. SQL Server allows you to create dynamic SQL statements. The statements use a SQL string varchar data type, then you execute the ...

I think it's been aluded to above, but SP's or Parameterised quieries are the way to go for no other reason that security.<BR><BR>If you are combinging strings to make a query, all a hacker has to ...

Parameter queries are not just for querying records when you know exactly what you’re looking for. You can also use them to search for records that contain any string of characters, anywhere in ...