Re: Looking for BASIC example of using embedded SQL for retrieving field value

[Scott Klement <rpg400-l@xxxxxxxxxxxxxxxx>]

I agree there's nothing wrong with using a cursor as needed, but...  you 
don't HAVE to use a cursor here.  you could do this:

C             eval      W$SQLCmd = 'Values( Select '+ PARM5
C                                         + ' from '+ PARM1
C                                         + ' Where '+ PARM3 +'=?'
C                                         + ') into ?';
C/Exec SQL    Prepare MYSTMT from :W$SQLCmd
C/End-Exec
C/Exec SQL    Execute MYSTMT Using :PARM4, :WRKFLD
C/End-Exec

Personally, trying to code this in fixed-format RPG causes my stomach to 
churn :)   But it should work without needing a cursor...

The danger of an SQL injection attack might be rather high if the 
PARMxxx variables don't come from a trusted source, and you haven't 
sanitized them.


rob@xxxxxxxxx wrote:
> Just to repeat, you should check SQLSTT after every exec sql statement. 
> See my sample earlier.
>
> Also, since you cannot do a 'select into' on a prepared statement you will 
> have to use a cursor.