Question

When I run the following code, I get an “invalid object name” error, any idea why?

I need to create a dynamically named temp table to be used in a stored procedure.

 DECLARE @SQL NVARCHAR(MAX)
 DECLARE @SessionID NVARCHAR(50)
 SET @SessionID = 'tmp5l7g9q3l1h1n5s4k9k7e'
 ;
 SET        
 @SQL = N'      CREATE TABLE #' + @SessionID + ' ' +
         N'     (' +
    N'      CustomerNo NVARCHAR(5), ' +
    N'      Product NVARCHAR(3), ' + 
    N'      Gross DECIMAL(18,8) ' +
    N'      )'
 ;
 EXECUTE sp_executesql @SQL
 ;
 SET        
 @SQL = N'      SELECT * FROM #' + @SessionID
 ;
 EXECUTE sp_executesql @SQL

Thanks!

Answer 1

You are doing it wrong!

Try:

exec(@SQL)

instead of:

EXECUTE sp_executesql @SQL

---

To use sp_executesql the variable must be inside @SessionID the quotes and it must be provided has input parameter. Check this for a full example!

---

You’ve to be aware that Dynamic SQL is a good port for SQL injections!