If the question is, whether SAP products typically run “EXEC” or “EXECUTE IMMEDIATE” statements with inline string replacement, then the answer is: no. That’s neither safe nor efficient.
What usually happens - say in the ABAP environment or in CAP - is that the query structure is generally defined in the application code and/or the CDS data model. During execution the filter and projection conditions are handed over to the DB interface. This DB interface either picks a matching prepared SQL statement from the cache or prepares a new statement with the required number of filter parameters/conditions and selected columns.
Once prepared, the actual filter values can be assigned to the query parameters and the statement is then executed.
So, instead of dynamic SQL, a query generator is used. Which is the case with pretty much the case any DB heavy application (think any application that uses a DB access framework, ORM framework, or that has a user configurable query interface).
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.