Why to avoid dynamic SQL queries ? any suggestion to remove there bad part and to use these?

Can you please guide me why dynami开发者_运维百科c SQL is suggested to avoid ? Is there any way that I can keep on using dynamic SQL and avoid its bad things ?

---

http://www.sommarskog.se/dynamic_sql.html

If you don't understand everything in this, come back and ask a question, but under no circustances should you use dynamic SQl until you understand this article.

---

The main problem is sql injection. People can enter data that can change the intent of your sql.

One of the best solutions is to use sp_executesql. http://msdn.microsoft.com/en-us/library/ms188001.aspx