Filtering Parameters in a SQL 2008 Stored Procedure

Ash explains the concept of Filtering Parameters in a Stored Procedure in this blog post.

This method is safer and more beneficial than dynamically creating and passing a sql query from the code layer and using sp_executesql, as it helps to avoid sql injection attacks.

However, the author explains there is a pitfall because you may sacrifice index optimization.

Check it out!

May your dreams be in ASP.NET and your code free from sql injections!

Nannette Thacker