Using QUOTENAME() to Protect Against SQLInjection

This short article describes you to simple way of protecting from SQLInjection.

http://www.sql-server-performance.com/2014/using-quotename-protect-sqlinjection/

Bobby Tables: A guide to preventing SQL injection

 

Source: http://bobby-tables.com/