Run a checked command in every database with a FAST_FORWARD cursor, AG role filter, QUOTENAME, and per-database error log.
Second-Order SQL Injection: When Stored Data Becomes Code
A safe insert does not make the saved value safe forever. Here is how stored text turns into code later, and the plain fix.
Dynamic ORDER BY Without Injection: Whitelisting Sort Columns
Parameters cannot name a column, so grids end up gluing text into SQL. Here is the approved-list pattern that keeps the sort safe.
Dynamic PIVOT: Building Report Columns From the Data
Build a dynamic PIVOT with ordered STRING_AGG and QUOTENAME, parameterized filters, zero-filled results, and explicit report-width limits.
SQL Injection: The Joke, the Failure and the Parameter Fix
SQL Injection makes a good joke and a terrible incident. The tests here show a concatenated query returning every row for one hostile name, the same text passed as a parameter returning none, a table name caught by QUOTENAME, and a read-only user blocked from dropping a table.
Parameterized Queries From Application Code
Use parameterized queries from application code to prevent SQL injection, improve plan reuse, and avoid parameter length mistakes.
Finding Dynamic SQL Open to Injection
Find dynamic SQL open to injection by searching module definitions for concatenation, then replace data concatenation with parameters.