Re: SQL Statement Not Allowed

Michael,

Seems to me, you're trying to do something like this
(This is off the top of my head, and untested)

/free
MySqlStmt = 'Select FLDA, FLDB +
From INVENTORY +
Where PARTNUM =' +
cBlank +
pInModel +
cBlank +
'For Read Only';

exec SQL prepare Foo from :MySqlStmt;
// check error

exec SQL declare Bar cursor for Foo;
exec SQL open Bar;
// check error

exec SQL set result sets with return to caller
cursor Bar;

I don't know that I would use dynamic SQL unless the WHERE list is _truly_ dynamic, and can really vary a lot... but if I did decide to use dynamic, I'd do it as coded above.

Please be aware that dynamic SQL statements like this are subject to SQL injection attacks... make sure you control and/or properly escape any data in your dynamic WHERE clause. (Or switch to a static statement.)


On 11/29/2010 4:14 PM, Michael Ryan wrote:

I think I may have minimized my example and totally obfuscated what I'm
trying to do. I want my RPG code to be an external program for a stored
procedure that I want to execute from my PHP script. I would have two
different selection criteria depending on the parms passed into the RPG
program. One selection would be where I'm searching for a partnumber, the
other would be when I'm searching with a partnumber and a vendor. That's why
I was thinking along the lines of a dynamically prepared statement. I could
change the statement (change the WHERE clause) depending on my selection
criteria.

So I would create the statement, prepare the statement, and then open the
cursor. I was thinking my CREATE PROCEDURE would call my RPG program,
passing in the parms and returning an open cursor. My PHP script would then
db2_exec the call to my stored procedure. Make sense? Am I way off base?
Thanks!