Question

I have the following dynamic SQL code with 4 columns inserted as parameters as well as the table name.

set @SQL = 'select EVENTID, RATE,' + @LossColumn + ',' + @ExpColumn + ',' + @StdDevIndep + ',' + @StdDevCorr + ', '''','''', '''','''' 
from Catastrophe.dbo.' + @CatTableName 
insert into AnalyticsV2.dbo.ResultCSVCat
execute sp_executesql @SQL

I’m not sure if this is correct or whether it needs unicode encoding because of the parameters (N before the ‘select statement)? It works fine if I specify all the columns and table name because then there are no parameters. I’m not quite sure how to change it around if it does need unicode because I haven’t worked with that very much in Microsoft SQL.

Any help will be appreciated!

Answer 1

Yes, dynamic SQL strings should always be declared as NVARCHAR and you should always use the N prefix.

DECLARE @sql NVARCHAR(MAX);

SET @sql = N'select EVENTID, RATE,' 
  + QUOTENAME(@LossColumn)  -- QUOTENAME is safer
  + ',' + QUOTENAME(@ExpColumn) 
  + ',' + QUOTENAME(@StdDevIndep) 
  + ',' + QUOTENAME(@StdDevCorr) 
  + ', '''','''', '''',''''  -- not sure I understand this, 
                             -- trying to insert empty strings?
FROM Catastrophe.dbo.' + QUOTENAME(@CatTableName) + ';';

INSERT INTO AnalyticsV2.dbo.ResultCSVCat -- no column list?
EXEC sp_executesql @sql;