Tóm tắt Viết SQL động chắc chắn là dùng trò chơi của bạn đến một cấp độ cao hơn. Mã tạo ra mã. Cool. Hãy nhớ luôn luôn được nhận thức hay không các thông số có thể được sử dụng để cho phép SQL injection. | Part IV Developing with SQL Server Summary Writing dynamic SQL is definitely taking your game to a higher level. Code that creates code. Cool. Remember to always be aware of whether or not the parameters can be used to enable SQL injection. A few key points from this chapter Build up the @SQLStr variable from the inside out start with the dynamic list and then append the SELECT prolog. If the WHERE clause is dynamic chances are good the FROM clause will be also. When writing dynamic SQL add a PRINT statement to output the @SQLStr variable during development. It makes debugging much easier. Use sp_executesql. If there s a different way to make the code flexible such as the parse and join method mentioned in the best practice do that instead of dynamic SQL. All the standard database integrity features . foreign keys help defend against SQL injection. Always think like a hacker. Where can an SQL injection string be used to alter the intention of the code Dynamic SQL is not necessarily ad-hoc SQL. Never permit ad-hoc SQL to your database. This concludes a ten-chapter discussion on T-SQL development that began with what is a batch and progressed to the point of code-generating batches. If you re up to writing code-generating code in T-SQL you re doing well as a SQL Server database developer. I congratulate you. 682 Data Connectivity s much as I d like to think that Management Studio is the ultimate UI and there s no need for any other interface to SQL Server the truth is that SQL Server needs to connect to nearly any possible data conduit. Other than Chapter 5 Client Connectivity all the code so far has occurred inside SQL Server. Part V focuses on myriad ways that data can be brought into and synchronized with SQL Server. Some of the connectivity technologies are well known and familiar technologies like the simple but mighty bulk insert distributed queries and linked servers replication and Microsoft Access. Other connectivity .
