Re: Variable File names in SQL Procedure

[Ron Adams <rondadams@xxxxxxxxx>]

Agreed, my preference would be dynamic SQL. However, I suppose I could
create a CL/SQL proc that would do it.
I'll have to ponder this.

Ron


On Thu, Mar 17, 2011 at 7:14 AM, Charles Wilt <charles.wilt@xxxxxxxxx>wrote:

> I'd prefer the dynamic SQL, since it's an all SQL solution.
>
> Chuck, any reason behind your preference for OVRDBF?
>
> My initial thought was perhaps immunity to SQL injection...but then I
> got to wondering if the use of QCMDEXC would be open to any attack...I
> can't think of a way...but...
>
> Charles
>
> On Thu, Mar 17, 2011 at 3:37 AM, CRPence <CRPbottle@xxxxxxxxx> wrote:
> >   I would use OVRDBF the literal PRCSHT [or any literal named on the
> > FROM clause] to the variable named library/file on the TOFILE()
> > parameter, along with appropriate override scope.  Issue an SQL CALL
> > QCMDEXC with a variable as the constructed command string, passed as the
> > first parameter and the trimmed length as the second parameter
> > [DECIMAL(15,5)].  That CALL would be used to effect the override before
> > the SQL INSERT is performed.  Another option [though not preferable IMO
> > due to its creating an object] is to CREATE ALIAS to the variable named
> > file, and use the ALIAS name instead of the file name in the FROM
> > statement; probably simpler to perform that statement versus building a
> > command string and length for the OVRDBF command string however.
> >
> >   Otherwise PREPARE and execute a dynamically constructed SQL statement
> > with the names concatenated into the FROM clause.
> --