{"id":78924,"date":"2026-11-10T19:40:24","date_gmt":"2026-11-10T19:40:24","guid":{"rendered":"http:\/\/bangla.sitestree.com\/?p=78924"},"modified":"2026-11-10T19:55:11","modified_gmt":"2026-11-10T19:55:11","slug":"rewritten-sql-server-75975","status":"publish","type":"post","link":"http:\/\/bangla.sitestree.com\/?p=78924","title":{"rendered":"SQL Server Dynamic SQL, Procedures, Cursors, and Injection: Concepts and Examples"},"content":{"rendered":"<p>Stored procedures, dynamic SQL, and cursors solve different problems. Good T-SQL design starts with ordinary set-based queries and introduces these features only when they are warranted.<\/p>\n<h2>Stored procedures<\/h2>\n<p>A stored procedure wraps reusable database logic, can accept parameters, and can return results. Its permissions and deployment lifecycle should be managed like application code.<\/p>\n<h2>Parameterized dynamic SQL<\/h2>\n<p>When the statement structure varies at runtime, sp_executesql can execute a statement with strongly typed values. Never concatenate untrusted values into a WHERE clause.<\/p>\n<h2>T-SQL example<\/h2>\n<pre><code>CREATE OR ALTER PROCEDURE dbo.FindOrders\n    @CustomerID int\nAS\nBEGIN\n    SET NOCOUNT ON;\n    DECLARE @sql nvarchar(max) =\n      N'SELECT OrderID, OrderDate FROM dbo.Orders WHERE CustomerID = @cid';\n    EXEC sys.sp_executesql @sql, N'@cid int', @cid = @CustomerID;\nEND;<\/code><\/pre>\n<h2>Identifiers and cursors<\/h2>\n<p>Parameter placeholders cannot substitute object names such as table or column identifiers. Validate against an allowlist and quote identifiers with QUOTENAME. Cursors process rows one at a time and can be useful for truly sequential operations; set-based UPDATE, INSERT, and window functions are usually preferable.<\/p>\n<h2>Injection prevention<\/h2>\n<p>Grant the database account minimal rights, validate dynamic object names, parameterize values, and do not treat simple quote escaping as a complete defense. Test failure paths as well as the successful query.<\/p>\n<hr\/>\n<p><strong>About this article:<\/strong> This AI-generated educational rewrite was prepared from an existing Open Education article, with new explanations and illustrative examples where helpful. <a href=\"https:\/\/bangla.sitestree.com\/?p=75975\">Read the earlier article (post 75975)<\/a>. The new text may be freely copied, edited, and reused with or without attribution to this site. Third-party material, brand names, and linked resources retain their own rights. <strong>AI can make mistakes:<\/strong> verify syntax, version support, security practices, and outcomes against official documentation before use, especially in production.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Stored procedures, dynamic SQL, and cursors solve different problems. Good T-SQL design starts with ordinary set-based queries and introduces these features only when they are warranted.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[20,182],"tags":[466],"class_list":["post-78924","post","type-post","status-publish","format-standard","hentry","category-information-technology","category---blog","tag-sql-server","item-wrap"],"jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":78947,"url":"http:\/\/bangla.sitestree.com\/?p=78947","url_meta":{"origin":78924,"position":0},"title":"SQL Server Cursors: How They Work and a Complete T-SQL Example","author":"Sayed","date":"November 10, 2026","format":false,"excerpt":"A cursor provides row-by-row navigation through a query result. It is helpful when a task genuinely needs sequential procedural work, but should not replace set-based SQL without a reason.","rel":"","context":"In &quot;Information Technology&quot;","block_context":{"text":"Information Technology","link":"http:\/\/bangla.sitestree.com\/?cat=20"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":78926,"url":"http:\/\/bangla.sitestree.com\/?p=78926","url_meta":{"origin":78924,"position":1},"title":"Learning T-SQL: Dynamic Queries, Stored Procedures, and Cursors","author":"Sayed","date":"November 10, 2026","format":false,"excerpt":"T-SQL extends SQL with variables, conditional logic, procedures, and server-side control flow. This hands-on tutorial connects these features to a simple product database.","rel":"","context":"In &quot;Information Technology&quot;","block_context":{"text":"Information Technology","link":"http:\/\/bangla.sitestree.com\/?cat=20"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":78936,"url":"http:\/\/bangla.sitestree.com\/?p=78936","url_meta":{"origin":78924,"position":2},"title":"C# and SQL Server: From Foreign Keys to Reusable Database Commands","author":"Sayed","date":"November 10, 2026","format":false,"excerpt":"Database-backed .NET applications depend on both a correct schema and correctly parameterized application queries. This tutorial links foreign keys, stored procedures, and prepared SQL commands.","rel":"","context":"In &quot;Information Technology&quot;","block_context":{"text":"Information Technology","link":"http:\/\/bangla.sitestree.com\/?cat=20"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":78933,"url":"http:\/\/bangla.sitestree.com\/?p=78933","url_meta":{"origin":78924,"position":3},"title":"Using C# with SQL Server: Relationships, Procedures, and Safe Parameters","author":"Sayed","date":"November 10, 2026","format":false,"excerpt":"C# applications typically access SQL Server through ADO.NET. A reliable design starts with proper relational constraints, calls stored procedures using typed parameters, and manages connections predictably.","rel":"","context":"In &quot;Information Technology&quot;","block_context":{"text":"Information Technology","link":"http:\/\/bangla.sitestree.com\/?cat=20"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":78969,"url":"http:\/\/bangla.sitestree.com\/?p=78969","url_meta":{"origin":78924,"position":4},"title":"Calling SQL Server Stored Procedures from Modern PHP: A Migration Tutorial","author":"Sayed","date":"November 10, 2026","format":false,"excerpt":"Old PHP code often used mssql_init, mssql_bind and mssql_execute. Those APIs are obsolete, but their basic goal\u2014calling a SQL Server stored procedure with typed parameters\u2014remains common.","rel":"","context":"In &quot;Information Technology&quot;","block_context":{"text":"Information Technology","link":"http:\/\/bangla.sitestree.com\/?cat=20"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":75827,"url":"http:\/\/bangla.sitestree.com\/?p=75827","url_meta":{"origin":78924,"position":5},"title":"MS SQL Server Dynamic SQl, T-SQL","author":"Sayed","date":"June 25, 2023","format":false,"excerpt":"MS SQL Server Dynamic SQl, T-SQL Mostly: Dynamic SQL Stored Procedure Trigger Cursor Function Sayed Ahmed What are the Most Important Most Used Design ERD Convert ERD to database Normalization Indexing SQL Stored Procedure Dynamic SQL These will come, not too frequent Function, User Defined Data Types, Temporary Table Trigger,\u2026","rel":"","context":"In &quot;\u09ac\u09cd\u09b2\u0997 \u0964 Blog&quot;","block_context":{"text":"\u09ac\u09cd\u09b2\u0997 \u0964 Blog","link":"http:\/\/bangla.sitestree.com\/?cat=182"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/bangla.sitestree.com\/index.php?rest_route=\/wp\/v2\/posts\/78924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/bangla.sitestree.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/bangla.sitestree.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/bangla.sitestree.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/bangla.sitestree.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=78924"}],"version-history":[{"count":1,"href":"http:\/\/bangla.sitestree.com\/index.php?rest_route=\/wp\/v2\/posts\/78924\/revisions"}],"predecessor-version":[{"id":78986,"href":"http:\/\/bangla.sitestree.com\/index.php?rest_route=\/wp\/v2\/posts\/78924\/revisions\/78986"}],"wp:attachment":[{"href":"http:\/\/bangla.sitestree.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=78924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/bangla.sitestree.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=78924"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/bangla.sitestree.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=78924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}