Dynamic SQL is open to SQL Injection, whereas 'Select WhateverField From WhateverView' is not.
Simply because the user has the right to open the view and filter it, but does not have any rights on the underlying tables.
From what I tested in an Access project linked to an SQL Server 2000,
Select
[Top 100 Percent] * From View Where SomeField = SomeCriteria
(the red part may be generally ommitted)
runs much faster than
Select * From View
which says that the server asseses the filter somehow before sending the result. And that may be good enough, depending on what you need.
Of course, it's often slower than a stored procedure, but if you have a 100 field resultset that should be filtered by the end-user according to his/her wishes, you will end up with a view or an in-line function that can be filtered from the client program.
Bottom line: you should never use Dynamic SQL if you care about your data at all. Instead, use views, in-line functions or stored procs.
Whatever you use, is far better than dynamic sql. I know a few guys who learnt it the hard way...
![[pipe] [pipe] [pipe]](/data/assets/smilies/pipe.gif)
Daniel Vlas
Systems Consultant