Ok, I'm trying to write a query in a stored procedure in SQL Server 2000. Because some of the parts of the query vary based on certain situations I construct a string that contains the query and ...

Such is the case with SQL queries. They seem so innocent, and so useful. But dangers lurk within every space-separated keyword. Consider a basic query crafted using ordinary C# string concatenation: / ...