Re: SQL Statement Not Allowed

[Scott Klement <rpg400-l@xxxxxxxxxxxxxxxx>]

Michael,

Seems to me, you're trying to do something like this
(This is off the top of my head, and untested)

 /free
     MySqlStmt = 'Select FLDA, FLDB +
                     From INVENTORY +
                     Where PARTNUM =' +
                       cBlank +
                       pInModel +
                       cBlank +
                     'For Read Only';

     exec SQL prepare Foo from :MySqlStmt;
     // check error

     exec SQL declare Bar cursor for Foo;
     exec SQL open Bar;
     // check error

     exec SQL set result sets with return to caller
                  cursor Bar;

I don't know that I would use dynamic SQL unless the WHERE list is 
_truly_ dynamic, and can really vary a lot...   but if I did decide to 
use dynamic, I'd do it as coded above.

Please be aware that dynamic SQL statements like this are subject to SQL 
injection attacks...  make sure you control and/or properly escape any 
data in your dynamic WHERE clause. (Or switch to a static statement.)


On 11/29/2010 4:14 PM, Michael Ryan wrote:
> I think I may have minimized my example and totally obfuscated what I'm
> trying to do. I want my RPG code to be an external program for a stored
> procedure that I want to execute from my PHP script. I would have two
> different selection criteria depending on the parms passed into the RPG
> program. One selection would be where I'm searching for a partnumber, the
> other would be when I'm searching with a partnumber and a vendor. That's why
> I was thinking along the lines of a dynamically prepared statement. I could
> change the statement (change the WHERE clause) depending on my selection
> criteria.
>
> So I would create the statement, prepare the statement, and then open the
> cursor. I was thinking my CREATE PROCEDURE would call my RPG program,
> passing in the parms and returning an open cursor. My PHP script would then
> db2_exec the call to my stored procedure. Make sense? Am I way off base?
> Thanks!