source
Using dynamic SQL is unavoidable at times, but it's reckless to execute dynamic SQL that is created from strings with values that change at execution time.
The Risks of Using EXECUTE ('SQL Script')
