Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hello all I'm having 1 Question with following query syntax

 ALTER TABLE table_name
 ADD column_name column-definition;

Question is can we use parameters to column_name field like @column_name? Because I'm creating columns which Column name is supplied by front end as a parameter. for example

ALTER TABLE table_name
ADD @column_name varchar(250);

this is giving error so any alternate for this?

share|improve this question
up vote 6 down vote accepted

Perhaps try:

DECLARE @sql varchar(max);
SET @sql = 'ALTER TABLE table_name ADD ' + @column_name + ' varchar(250);';
EXEC (@sql);
share|improve this answer
To be on the safe side from malicious or ignorant end-users you should use quotename(). quotename(@column_name) – Mikael Eriksson Apr 4 '12 at 13:04
Another good option. – OliverAsmus Apr 4 '12 at 14:07
@MikaelEriksson what are the advantages of using quotename(@column_name) over @column_name? – M.S.Nayak Apr 5 '12 at 5:30
@M.S.Nayak - It will remove (I belive) the risk of SQL-injection and it will allow your column names to contain otherwise invalid characters like space. For more info you can have a look here: The Curse and Blessings of Dynamic SQL – Mikael Eriksson Apr 5 '12 at 5:36
@MikaelEriksson Thanks I got it referred – M.S.Nayak Apr 5 '12 at 7:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.