Question

I have a query that returns value of a field sent through parameter :

@Field nvarchar(50),
@ID int
...

execute('SELECT ' + @Field + ' from SampleTable where (ID=' + @ID + ');');

I’m doing this to have one SP instead of several SP’s with the same structure .
Now I’m not sure is this safe or not ?

Answer 1

You should use sp_executesql and quotename to be safe.

declare @SQL nvarchar(max)
set @SQL = 'select '+quotename(@Field)+' from SampleTable where ID = @ID'
exec sp_executesql @SQL, N'@ID int', @ID