Re: SQL Statement Not Allowed

Thanks Rory...I think I'll have to encapsulate this in a stored procedure so
I can do additional processing and put the results into a data structure
array. Or is there a restriction on that in embedded SQL? Seems I recall
something about that.

And thanks for the reinforcement about parametertizing the statements.

- Michael



On Tue, Nov 30, 2010 at 12:56 PM, Rory Hewitt <rory.hewitt@xxxxxxxxx> wrote:

Michael,

If you think that you'll only be using these two possible statements, then
it might be better to have two separate static SQL statements (one for
searching by SKU and one for searching by partnumber/vendor). Of course,
if,
as you say, you might be expanding this in the future, then that wouldn't
work, but my guess is that there are a limited number of possible SELECT
statements that you would use...

As Charles poiints out, be VERY careful about the possibility of SQL
injection - use parameterized SQL rather than building a statement as in
your first examples.

Rory

On Tue, Nov 30, 2010 at 5:17 AM, Michael Ryan <michaelrtr@xxxxxxxxx>
wrote:

Hi Birgitta -

The SELECTs *aren't* identical except for the vendor - I should have made
that more clear. One SELECT case is when a SKU is passed in, and I need

to

search by SKU. Another is when a partnumber and vendor are passed in -

then

I need to search by partnumber and vendor. That's why I was thinking I
needed dynamic SQL.

--
This is the RPG programming on the IBM i / System i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/rpg400-l.