Re: SQL Statement Not Allowed

[Rory Hewitt <rory.hewitt@xxxxxxxxx>]

Michael,

If you think that you'll only be using these two possible statements, then
it might be better to have two separate static SQL statements (one for
searching by SKU and one for searching by partnumber/vendor). Of course, if,
as you say, you might be expanding this in the future, then that wouldn't
work, but my guess is that there are a limited number of possible SELECT
statements that you would use...

As Charles poiints out, be VERY careful about the possibility of SQL
injection - use parameterized SQL rather than building a statement as in
your first examples.

Rory

On Tue, Nov 30, 2010 at 5:17 AM, Michael Ryan <michaelrtr@xxxxxxxxx> wrote:

> Hi Birgitta -
>
> The SELECTs *aren't* identical except for the vendor - I should have made
> that more clear. One SELECT case is when a SKU is passed in, and I need to
> search by SKU. Another is when a partnumber and vendor are passed in - then
> I need to search by partnumber and vendor. That's why I was thinking I
> needed dynamic SQL.