Using QUOTENAME() to Protect Against SQLInjection

This short article describes you to simple way of protecting from SQLInjection.

http://www.sql-server-performance.com/2014/using-quotename-protect-sqlinjection/