Re: executing an SQL statement stored in a string

[Roland Bouman]

yes, Prepared statement (see: http://dev.mysql.com/doc/refman/5.0/en/sqlps.html; but also: http://mysql.gilfster.com/page.php?parent_id=1.3&page_id=1.3.6) syntax.

You have to use user variables (see: http://dev.mysql.com/doc/refman/5.0/en/variables.html and http://dev.mysql.com/doc/refman/5.0/en/example-user-variables.html) though, you can only use literal string or user variables, NOT stored procedure variables (at least, not directly):

create procedure test(inwhereclause varchar(200))
begin

set @sqltoexecute = concat('select * from testtable',inwhereclause);

prepare stmt from @sqltoexecute;
execute stmt;
deallocate prepare stmt;
end