Database

set @sql = 'select * from tblname where ' + 
@columnname + ' = ' + CAST(@value AS NVARCHAR(50)) 
EXEC(@sql)

create proc sp_temp 
@columnname varchar(25),
@value varchar(25) 
as 
 
DECLARE @SQLQuery AS NVARCHAR(500)
DECLARE @ParameterDefinition AS NVARCHAR(100)
 
set @SQLQuery = 'select * from tblname where (1=1) AND ' 
 
IF @columnname = 'EmpID'
BEGIN
set @SQLQuery = @SQLQuery + @columnname + ' =  @value' 
SET @ParameterDefinition =  '@value INT'
END
 
IF @columnname = 'EmpName' 
BEGIN
set @SQLQuery = @SQLQuery + @columnname + ' = @value' 
SET @ParameterDefinition =  '@value NVARCHAR(25)'
END
 
EXECUTE sp_executesql @SQLQuery, @ParameterDefinition, @value
 
GO

hspc wrote:

In addition, SQL Server 2005 encryption can be used