Re: Variable File names in SQL Procedure

[Charles Wilt <charles.wilt@xxxxxxxxx>]

I'd prefer the dynamic SQL, since it's an all SQL solution.

Chuck, any reason behind your preference for OVRDBF?

My initial thought was perhaps immunity to SQL injection...but then I
got to wondering if the use of QCMDEXC would be open to any attack...I
can't think of a way...but...

Charles

On Thu, Mar 17, 2011 at 3:37 AM, CRPence <CRPbottle@xxxxxxxxx> wrote:
>   I would use OVRDBF the literal PRCSHT [or any literal named on the
> FROM clause] to the variable named library/file on the TOFILE()
> parameter, along with appropriate override scope.  Issue an SQL CALL
> QCMDEXC with a variable as the constructed command string, passed as the
> first parameter and the trimmed length as the second parameter
> [DECIMAL(15,5)].  That CALL would be used to effect the override before
> the SQL INSERT is performed.  Another option [though not preferable IMO
> due to its creating an object] is to CREATE ALIAS to the variable named
> file, and use the ALIAS name instead of the file name in the FROM
> statement; probably simpler to perform that statement versus building a
> command string and length for the OVRDBF command string however.
>
>   Otherwise PREPARE and execute a dynamically constructed SQL statement
> with the names concatenated into the FROM clause.