Constructing a query at runtime with string concatenation operations and executing the query from that string.
SQL has limited facilities for abstraction and it may be necessary to implement processing by constructing a SQL query at runtime. Normally the term is used when this is done within a stored procedure in the database itself.
While it gives effectively infinite flexibility, dynamic SQL has some drawbacks, including:
The query optimiser must re-calculate a query plan for the query; often systems can't cache query plans for dynamically generated SQL.
Constructing a query through string concatenation can lead to SQL injection vulnerabilities. Some systems allow queries of this sort to be executed with parameters but variadic parameters are a common application for dynamic SQL and this might not be possible.