Passing query string through variable value fails [duplicate]

Question

Using Microsoft SQL Server 2015

This works

create procedure Checking1(@SQLQueryString nvarchar(max))
as
begin

select * from MyTable

end

This is not working

create procedure Checking1(@SQLQueryString nvarchar(max))
as
begin

@SQLQueryString

end;

What am I doing wrong?

learn.microsoft.com/en-us/sql/relational-databases/… or mssqltips.com/sqlservertip/1160/… — Sergey
– Sergey, Commented Jul 28, 2022 at 8:53
Please move your suggestion as answer. I will mark it as answer. From your source I understand that I need to call it as like exec(@SQLQueryString). — Sixthsense
– Sixthsense, Commented Jul 28, 2022 at 8:58
This smells like an XY Problem. Passing a string to just execute is a HUGE security vulnerability. What controls do you have to stop a user running DROP TABLE dbo.MyTable or CREATE LOGIN a WITH PASSWORD = '1', CHECK_POLICY = OFF; ALTER SERVER ROLE sysadmin ADD MEMBER a;? — Thom A
– Thom A ♦, Commented Jul 28, 2022 at 9:04

Sergey · Accepted Answer · 2022-07-28 08:59:30Z

0

You need to tell SQL Server to execute your dynamic-SQL

answered Jul 28, 2022 at 8:59

Sergey

5,2801 gold badge9 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1