Francisco H Tapia
my.lists at verizon.net
Wed Aug 13 12:06:21 CDT 2003
Since you are passing the table name I can only assume that this sp is creating a dynamic SQL, for this to work efficiently your users will need direct select rights to the table instead of simply just EXEC rights on the procedure. The common practice is to disable all rights to tables to you users and have them go through views and sprocs. just my 2 cents. -Francisco http://rcm.netfirms.com On Wednesday, August 13, 2003 12:56 AM [GMT-8], Martin Reid <mwp.reid at qub.ac.uk> wrote: : Hi All : : Any comments on the following in terms of performance or anything : else that springs to mind. I have a couple of concerns over this : approach re recompiling of the SP every time it is called. : : Say I want to build a drop list on the form for the user to select : from and the drop list is from a table. Now, the application has : many forms with drop lists. Instead of having a separate SP for each : drop list, we create a generic SP that accepts the field names as a : string separated by commas. In my code, for each form, I would : define what these fields would be in an array. Then, with the VB : join function, the array is made into a comma separated string of : strings that is passed, along with the table name, to the generic : stored procedure. The stored procedure will take these two : parameters and convert it into a select statement, process it and : return the data for my code to process into the drop list. Another : parameter can be passed for setting the field or fields that are used : for ordering the data (for example order by name). : : : Martin : : _______________________________________________ : dba-SQLServer mailing list : dba-SQLServer at databaseadvisors.com : http://databaseadvisors.com/mailman/listinfo/dba-sqlserver : http://www.databaseadvisors.com