While I would prefer to generate true dynamic SQL statements with strongly-typed parameters, concatenation is probably ok here because the proper way will be a lot more cumbersome. I do, however, prefer sp_executesql
over EXEC()
prefer sp_executesql
over EXEC()
, always.
DECLARE @sql NVARCHAR(MAX) = N'';
SELECT @sql = @sql + N'EXEC [sim].[ROI_Save] '
+ CONVERT(varchar(6), VSL.PathId) + N', '
+ CONVERT(varchar(6), @ROIResultId) + N', '
+ CONVERT(varchar(6), RT.routeTypeResultId) + N', '
+ CONVERT(varchar(6), RT.ROI_RouteTypeId) + N'; '
FROM @routeResultIds AS RT
JOIN sim.ROI_Result_Vehicle AS VSL
ON RT.ROI_Result_VehicleId = VSL.ROI_Result_VehicleId;
EXEC sys.sp_executesql @sql;
I still don't like that the parameters to the procedure aren't named, and if any of your parameter values were strings or dates, the build-up of single quotes would quickly get very annoying.