Andy Brownsword does things right, after a fashion:
When building dynamic SQL, safety is crucial. As we saw last week, we have the
QUOTENAMEfunction which can help when referencing object names.Another aspect to consider is use of parameters. Integrating them incorrectly can leave us vulnerable to SQL injection attacks. Let’s take a look at how to handle them the wrong way, followed by the right way.
Why have the wrong way and then the right way? The answer is simple. It is a truth universally acknowledged, that a post with a Gallant must be in want of a Goofus.