Request for Feedback - Using variables as statement parameters

[VolkerBarth]

We are investigating expanding the ability to use variables in various statements in a future release of SQL Anywhere. This would reduce the reliance on EXECUTE IMMEDIATE, which can often be the source of application errors that cannot be detected until runtime and can be a vector for SQL injection attacks. We are not considering removing EXECUTE IMMEDIATE, just providing some alternatives to make dynamic SQL execution more developer friendly.

For example, DROP CONNECTION < connection-id > currently only allows you to specify an integer connection id. So in order to drop a connection in script, you need to build and execute a statement using EXECUTE IMMEDIATE.

eg.
SET sql-stmt = 'DROP CONNECTION ' + conn-id-variable;
EXECUTE IMMEDIATE sql-stmt;

If we allowed <connection-id> to be a variable, you could execute the statement directly
eg. DROP CONNECTION conn-id-variable;

Are there any statements in SQL Anywhere that you would like to see accept variables in place of identifiers and/or literal values? Examples would be helpful, but are not required.

[VolkerBarth]

I don't have an actual suggestion currently but would like to thanks for the public "RFF" - we surely like to give more feedback on further requests:)

[MCMartin]

Probably not exactly what you are asking for, but you could maybe create a solution for my question Materialized view with Parameter?