Security

Security in SQL Server

---

T-SQL: Dynamic SQL and SQL Injection (sp_executesql)

2016-04-13  in Security / SQL Injection / T-SQL  tagged Built-In Function / SQL Injection / T-SQL by Peter Lalovsky

When we create dynamic SQL code, we can add the parameters in two ways: Concatenate them into the dynamic code with + Use sp_executesql

---

---