Constructing a query at runtime with string concatenation operations and executing the query from that string.

SQL has limited facilities for abstraction and it may be necessary to implement processing by constructing a SQL query at runtime. Normally the term is used when this is done within a stored procedure in the database itself.

While it gives effectively infinite flexibility, dynamic SQL has some drawbacks, including:

  • The query optimiser must re-calculate a query plan for the query; often systems can't cache query plans for dynamically generated SQL.

  • Constructing a query through string concatenation can lead to SQL injection vulnerabilities. Some systems allow queries of this sort to be executed with parameters but variadic parameters are a common application for dynamic SQL and this might not be possible.