convert mysql stored procedure to mssql

Question

I need to used dynamic order query in mysql and i have successfully achieved that through string concatenation in mysql as follows:

set @stmt_text := concat('select * from abc order by ',sorder);

prepare stmt_handle from @stmt_text;

execute stmt_handle;

deallocate prepare stmt_handle;

i need a similar way to convert this in mssql

Any ideas??

Answer 1

Yes, just run it like this:

execute ('select * from abc order by ' + @sorder);

But don't forget that you need to verify the sorder variable if you get it through user input (to stop sql-injections)