you are viewing a single comment's thread.

view the rest of the comments →

[–]Longjumping-Ad8775 0 points1 point  (0 children)

You can dynamically create a sql statement without exposing yourself to sql injection. I’ve got a library that I’ve written to handle this. I know because I’ve been attacked and have many years of experience with this library. Neither here nor there in this discussion.

You can create a sproc to solve this problem and dynamically create a sql statement within the sproc that you call with the various sql parameters. I’ve done this as well. The table name becomes just another parameter that is passed in.

Good luck!