Thanks Gregory for this nice peace, good job!
Missed seeing one essential thing though in the injection part and that is a strong coupling to the metadata. If a user can select in any form the objects (table/view/procedure etc.) to use, one should do a firm check for it's existence. A quick sample would be
DECLARE @SCHEMA NVARCHAR(128) = N'dbo';
DECLARE @TABLE NVARCHAR(128) = N'CLIENT';
DECLARE @COLUMN NVARCHAR(128) = N'CLIENT_NAME';
DECLARE @SQL_STR NVARCHAR(MAX) = N''
@SQL_STR = N'SELECT ' +
+ N' FROM ' + TABLE_SCHEMA
+ NCHAR(46) + TABLE_NAME
WHERE COLUMN_NAME = @COLUMN
AND TABLE_NAME = @TABLE
AND TABLE_SCHEMA = @SCHEMA
--- and so on