Database

ALTER PROCEDURE [dbo].[SP_SearchByUserNeed]
(	
@ColumnName varchar(20),
@Value Varchar(100)
)
AS
BEGIN
BEGIN try
declare @qry nvarchar(max);
set @qry = 'Select * From Product where @ColumnName like ' + '''' +  @Value + '%' + '''';
exec(@qry);
END try
BEGIN catch
print('Error in [SP_SearchByProductName]')
END catch
END

DECLARE @strSQL NVARCHAR(1000); 
SET @strSQL = N'Select * From Product where ' + @ColumnName + ' like @Value+''%'';';
EXECUTE sp_executesql @strSQL, @Value

ALTER PROCEDURE dbo.SP_SearchByUserNeed
(
    @ColumnName varchar(20),
    @Value varchar(100)
)
AS
BEGIN
DECLARE @RealColumnName sysname;
DECLARE @Statement nvarchar(max);
    
    -- Validate the column name:
    SELECT
        @RealColumnName = name
    FROM
        sys.columns
    WHERE
        object_id = OBJECT_ID('Product')
    And
        name = @ColumnName
    ;
    
    If @RealColumnName Is Null
    BEGIN
        RAISERROR('Unknown column: "%s"', 16, 1, @ColumnName);
        Return;
    END;
    
    SET @Statement = N'SELECT * FROM Product WHERE ' + QuoteName(@RealColumnName) + N' Like @Value + ''%''';
    EXEC sp_executesql @Statement, N'@Value varchar(100)', @Value;
END

exec sp_stored_procedures @sp_owner = 'dbo'

SELECT *
   FROM sys.fn_dblog(NULL,NULL)

Bastard Programmer from Hell
If you can't read my code, try converting it here[^]

Schatak wrote:

seems to be good and new thing