Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

 All Forums
 SQL Server 2005 Forums
 Transact-SQL (2005)
 String Concetination

Author  Topic 

Jaiprakash15
Starting Member

1 Post

Posted - 2010-05-28 : 09:43:58
Hi there,

i have created a stored procedure..where i have to pass database name as parameter to a stored procedure which will get values from the database which was passed. am getting an error as "Must declare the table variable "@@ncEmplyoeeTbl"."

declare @ncDBName as varchar(50),
@ncPatientTbl as varchar(50)
set @ncDBName = 'Database_Emp'
set @ncEmplyoeeTbl = @ncDBName + '.dbo.' + 'tblemployee'
print @ncEmplyoeeTbl
select * from @ncEmplyoeeTbl

am not able to excecute the statment.

PLease suggest.

jimf
Master Smack Fu Yak Hacker

2875 Posts

Posted - 2010-05-28 : 10:13:00
First you need to declare the variable @ncEmplyoeeTbl (or is that declared as part of the procedure?)
Second you have to use dynamic sql for what you're trying to accomplish

declare @sql varchar(max)
set @sql = 'select * from ' + @ncEmploeeTbl

EXEC(@sql)

Jim

Everyday I learn something that somebody else already knew
Go to Top of Page

Kristen
Test

22859 Posts

Posted - 2010-05-28 : 10:35:23
and also beware SQL Injection ...
Go to Top of Page

madhivanan
Premature Yak Congratulator

22864 Posts

Posted - 2010-05-28 : 10:40:46
quote:
Originally posted by Kristen

and also beware SQL Injection ...


Here is the derived table approach that can avoid sql injection
Under method2,

Method 1 is hard to break
Method 2 is impossible to break

http://beyondrelational.com/blogs/madhivanan/archive/2010/05/14/derived-table-new-approach-to-avoid-sql-injection.aspx

Madhivanan

Failing to plan is Planning to fail
Go to Top of Page
   

- Advertisement -