Skip Headers

# Using an SQLCall

Previous

Next

You can provide an `SQLCall` object to any query instead of an expression, but the SQL string contained in the `SQLCall` must return all data required to build an instance of the queried class.

The SQL string can be a complex SQL query, a stored procedure call, or a stored function call. You can specify input, output, and input/output parameters.

You can invoke an `SQLCall` through a session query method (as Example: Session Read Query With Custom SQL illustrates) or through a `DatabaseQuery`.

Session Read Query With Custom SQL

    List result = session.executeSelectingCall(
        new SQLCall("SELECT * FROM EMPLOYEE WHERE EMP_ID = 44"));

WARNING: Allowing an unverified SQL string to be passed into methods makes your application vulnerable to SQL injection attacks.

TopLink assumes that a token in the custom SQL string of an `SQLCall` is a parameter if it is prefixed with one or more number signs (`#` ). You can bind values to these parameters using query API, as the following sections describe:

- Specifying a SQLCall Input Parameter

- Specifying a SQLCall Output Parameter

- Specifying a SQLCall Input / Output Parameter