Dynamic HANA SQL Script? Is it bad?

[Former Member]

Hi experts,

I just started using HANA SQL but have been doing SQL for quite a while now.

I know that in SQL, using Dynamic SQL is bad as it imposes security risks such as SQL injection.

Does the same thing apply to HANA SQL? Like, if you were to create a variable that holds an SQL that creates a table then execute it.

Or is there a similar thing like in SQL, you have to use Parameterized SQL Queries?

Thanks,

Raye

[lucas_oliveira]

Hello Raye,

If you meant HANA SQLScript then yes, using dynamic SQL constructions such as EXEC on your procedure should be avoided for the reasons you mentioned. See

SQLScript Security Considerations - SAP HANA SQLScript Reference - SAP Library

BRs,

Lucas de Oliveira