Why should you care?

Admin report builder lets ops pick sort column safely through whitelist + dynamic SQL instead of hardcoding fifty queries.

See it live — copy this example

Run in MySQL Workbench or the mysql CLI.

SET @sql = CONCAT(
  'SELECT order_id, order_ref, total_inr FROM orders ORDER BY ',
  'total_inr DESC LIMIT 5'
);
PREPARE stmt FROM @sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;

What happened?

• CONCAT builds SELECT string.
• PREPARE parses it; EXECUTE runs; DEALLOCATE frees.
• Never concat raw user input — whitelist allowed fragments only.

Practice next

1. Run example in Workbench.
2. Change ORDER BY column via variable with IF validation.
3. Try invalid column — prepare error.
4. Use user variable for LIMIT with CAST to UNSIGNED.
5. Stored procedure with CASE picking among fixed query texts instead.

Remember

PREPARE/EXECUTE for runtime SQL text. Whitelist dynamic parts strictly. Prefer static SQL when possible.

DataFlow ops report picker

Internal tool allows ORDER BY total_inr or order_id from dropdown — mapped to safe @sql.

Outcome: Flexible reports without fifty stored procedures.