Click here to Skip to main content
15,611,036 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
SQL
SELECT @ACCSERVER = ACCOUNTSERVER, @ACCDB = ACCOUNTDB FROM PRADNYA.DBO.MULTICOMPANY 
WHERE EXCHANGE = 'NSE' AND SEGMENT = 'CAPITAL' AND PRIMARYSERVER = 1

SET @REPORT_FORMULA = '-VDTBAL, -EDTBAL, FDT_RECEIPT, FDT_PAYMENTS'
SET @@DATA_ADB = ''
SELECT @@DATA_SRV = SHARESERVER, @@DATA_SDB = SHAREDB,	@@DATA_ADB = ACCOUNTDB,	@EXCHANGE = EXCHANGE, @SEGMENT = SEGMENT FROM PRADNYA.DBO.MULTICOMPANY 
WHERE EXCHANGE = 'BSE' AND SEGMENT = 'CAPITAL' AND PRIMARYSERVER = 1
AND NOT (ACCOUNTSERVER = @ACCSERVER
AND ACCOUNTDB = @ACCDB)

IF ISNULL(@@DATA_ADB, '') <> ''
BEGIN
	SET @@SQL = "DELETE FROM " + @@DATA_SRV + "." + @@DATA_ADB + ".DBO.FORMULA_CLIENT_MASTER WHERE SESSION_ID = '" + @SESSIONID + "'"

	SET @@SQL = @@SQL + " INSERT INTO " + @@DATA_SRV + "." + @@DATA_ADB + ".DBO.FORMULA_CLIENT_MASTER "
	SET @@SQL = @@SQL + " SELECT CLTCODE, PARTY_NAME, 'PARTY', '', '" + @SESSIONID + "', GETDATE() FROM FORMULA_CLIENT_MASTER WHERE SESSION_ID = '" + @SESSIONID + "'"
      
	SET @@SQL = @@SQL + " INSERT INTO #LEDGER_DETAILS "
	SET @@SQL = @@SQL + " EXEC " + @@DATA_SRV + "." + @@DATA_ADB + ".DBO.GET_LEDGER_AUDIT_DATA "    
	SET @@SQL = @@SQL + "'" +  @REPORT_DATE + "', "        
	SET @@SQL = @@SQL + "'" +  @SESSIONID + "', "        
	SET @@SQL = @@SQL + "'', "
	SET @@SQL = @@SQL + "'" + @REPORT_FORMULA + "', "
	SET @@SQL = @@SQL + "'" + @EXCHANGE + "',"
	SET @@SQL = @@SQL + "'" + @SEGMENT + "'"


What I have tried:

Hi have tried but no luck, Please help me out.
Thanks
Posted
Updated 7-Apr-22 21:11pm
v2
Comments
OriginalGriff 8-Apr-22 2:16am    
What have you tried?
Where are you stuck?
What did it do that you didn't expect, or not do that you did?
What have you tried to do to find out why?
Are there any error messages, and if so, where and when? What did you do to make them happen?

What help do you need?

Use the "Improve question" widget to edit your question and provide better information.

1 solution

Use:
SQL
Print @@SQL

to get the body of query. Then use it and convert to stored procedure[^].

At this moment your query is sql injection[^] vulnerable!!!
 
Share this answer
 
Comments
Santosh Thengdi 8-Apr-22 4:46am    
want to remove SET @@SQL = @@SQL from query and make a simple query.
Please suggest
Maciej Los 8-Apr-22 4:49am    
Please, read my answer carefully.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900