Posted by Erland Sommarskog on 12/20/06 22:50

fireball (fireball@onet.kropka.eu) writes:
> please, in simple words, what is difference between :
> sp_executesql
> and
> EXECUTE

sp_executesql gives you the possibility to use parameterised statements,
EXEC() does not. Parameterised statements have two important advantages:

o No risk for SQL injection.
o Better plan reuse in the plan cache.

For more details on this point, I have an article on my web site that
goes into detail on dynamic SQL, http://www.sommarskog.se/dynamic_sql.html.

--
Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se

Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/prodtechnol/sql/2005/downloads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodinfo/previousversions/books.mspx

[Back to original message]