Press "Enter" to skip to content

Using QUOTENAME() to Secure Dynamic SQL

Published 2024-03-19 by Kevin Feasel

Andy Brownsword uses the QUOTENAME() function:

I’m a big fan of dynamic SQL in the right conditions. One key to crafting safe dynamic query of the use of the QUOTENAME function.

My personal preference is to use exec sp_executesql for parameterization instead, simply because it’s a lot harder to mess up.

Published in Security, Syntax and T-SQL