Stairway to T-SQL: Beyond The Basics Level 9: Dynamic T-SQL Code
There times when you need to write T-SQL code that creates specific T-SQL Code and executes it. When you do this you are creating dynamic T-SQL code. When writing dynamic T-SQL you need to understand how dynamic code opens the possibilities for a SQL injection attack.