How to pass a string as as parameter for EXECUTE IMMEDIATE?

[Atomium]

I'm taking the SQL programming and procedural logic course on the academy.

One of the lessons concerns EXECUTE IMMEDIATE. It's a bit confusing: the slides use a syntax with (?) as parameter marker, while the video demo uses a syntax with double pipe.

So first question: which of these two syntaxes is the preferred one?

In the lab environment, I tried to use EXECUTE IMMEDIATE to dynamically select a column from a table, passing the name of the column as a parameter. This is the code:

DECLARE OR REPLACE column_name STRING = "o_orderpriority";
DECLARE OR REPLACE sql_string STRING = 
"SELECT (?) FROM orders LIMIT 10";

EXECUTE IMMEDIATE sql_string USING column_name;

The result is a table with a column that contains 10 times the word o_orderpriority.

Second question: is there a way to make EXECUTE IMMEDIATE interpret the parameter value as a column name, and not as a literal string?

[bianca_unifeye · Accepted solution]

This is expected behaviour.

• ? parameter markers (with USING) are only for values, not for SQL identifiers.

• When you pass a column name via ?, Databricks correctly treats it as a string literal, not as a column reference.

That’s why:

SELECT (?) FROM orders

returns a column containing the literal text o_orderpriority.

If you need to dynamically select a column name, you must build it into the SQL string:

SET sql_string =
  'SELECT ' || column_name || ' FROM orders LIMIT 10';

EXECUTE IMMEDIATE sql_string;

Rule of thumb:

• Identifiers (tables, columns) → string concatenation

• Values → ? + USING

This separation is intentional for correctness and SQL injection safety.

[Atomium]

Thank you for your clear explanation!

The lab example uses a parameter to pass the name of a column to sort on. That got me on the wrong foot...