Home Forums SQL Server 2014 Development - SQL Server 2014 Sanitising inputs when creating a sql string by concatenation in C# RE: Sanitising inputs when creating a sql string by concatenation in C#

  • March 20, 2014 at 11:20 am

    #1698809

    You could create the table with a placeholder name you generate, then use sp_rename @generatedName, @userName; to pass the user defined name as a parameter so that you don't have to concatenate it into a string

    I like your thinking. I wasn't aware of that sp so will have to give it a look.