Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

 All Forums
 SQL Server 2000 Forums
 SQL Server Development (2000)
 Dynamic sql performance

Author  Topic 

sasan_vm
Yak Posting Veteran

51 Posts

Posted - 2011-07-18 : 04:10:23
Hello,

Is any difference between this two procedure on performance ?

Regards,
sasan.

CREATE   PROC	pr_TableData
@table sysname ,
@clause nvarchar(3000)=null
AS
BEGIN
SET NOCOUNT ON

DECLARE @IdError int
DECLARE @sql nvarchar(4000)

IF @clause IS NULL
BEGIN
SELECT @sql = 'SELECT * FROM [' + @table + ']' +
' SELECT @IdError = @@error'
EXEC sp_executesql @sql, N'@table sysname, @IdError int output', @table, @IdError output
END
ELSE
BEGIN
DECLARE @sub nvarchar(4000)

SELECT @clause = replace(@clause, '"', '''')
SELECT @sub = ' WHERE (' + @clause + ')'
SELECT @sql = 'SELECT * FROM [' + @table + '] WHERE (' + @clause + ')' +
' SELECT @IdError = @@error'
EXEC sp_executesql @sql, N'@table sysname, @clause nvarchar(3000), @IdError int output', @table, @clause, @IdError
END

RETURN @IdError
END


CREATE   PROC	pr_MyTableData
@clause nvarchar(3000)=null
AS
BEGIN
SET NOCOUNT ON

DECLARE @IdError int
DECLARE @sql nvarchar(4000)

IF @clause IS NULL
BEGIN
SELECT @sql = 'SELECT * FROM tbl_my_data' +
' SELECT @IdError = @@error'
EXEC sp_executesql @sql, N'@IdError int output', @IdError output
END
ELSE
BEGIN
DECLARE @sub nvarchar(4000)

SELECT @clause = replace(@clause, '"', '''')
SELECT @sub = ' WHERE (' + @clause + ')'
SELECT @sql = 'SELECT * FROM tbl_my_data WHERE (' + @clause + ')' +
' SELECT @IdError = @@error'
EXEC sp_executesql @sql, N'@clause nvarchar(3000), @IdError int output', @clause, @IdError
END

RETURN @IdError
END

RickD
Slow But Sure Yak Herding Master

3608 Posts

Posted - 2011-07-18 : 05:43:01
Probably not, but it would depend on the table you are passing to the first query. They are both dynamic sql and depending on where they are called, you may open yourself to a SQL Injection, especially as you do not check the value passed in.
Go to Top of Page
   

- Advertisement -