A safe insert does not make the saved value safe forever. Here is how stored text turns into code later, and the plain fix.
Dynamic ORDER BY Without Injection: Whitelisting Sort Columns
Parameters cannot name a column, so grids end up gluing text into SQL. Here is the approved-list pattern that keeps the sort safe.
Dynamic PIVOT: Building Report Columns From the Data
Build a dynamic PIVOT with ordered STRING_AGG and QUOTENAME, parameterized filters, zero-filled results, and explicit report-width limits.
Parameterized Queries From Application Code
Use parameterized queries from application code to prevent SQL injection, improve plan reuse, and avoid parameter length mistakes.
Finding Dynamic SQL Open to Injection
Find dynamic SQL open to injection by searching module definitions for concatenation, then replace data concatenation with parameters.
Testing an Application for SQL Injection
Testing an application for SQL injection on a safe copy reveals response clues and unsafe query construction before repair.