thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Data & Analytics · Advanced

Dynamic SQL

SQL statements built as strings at run time and then executed, for example with EXEC, sp_executesql or EXECUTE IMMEDIATE.

Definition

Dynamic SQL enables flexible queries, such as variable table names or optional filters, but concatenating user input creates SQL injection risk. Use parameterized execution (sp_executesql with parameters, bind variables) and whitelist object names.

Example

EXEC sp_executesql N'SELECT * FROM Orders WHERE CustomerID = @c', N'@c INT', @c = 42;

Exam tip

Dynamic SQL built by string concatenation of user input is the classic SQL injection setup.

Related terms