I don't know if understand you, but anyway. I use function like this to check the string for parameters:
Function Fstr(varInput as variant) as string
Dim varTemp As String
If Len(Trim(Nz(varInput, ""))) = 0 Then
varTemp = ""
Else
varTemp = Replace(varInput, "'", "''")
varTemp = Replace(varTemp, """", """""""")
End If
FStr = varTemp
End Function
And here is primer for SP. Parameter myVar go through Fstr function:
CREATE PROCEDURE test_sp
@myVar varchar(50) = null
AS
SET NOCOUNT ON
DECLARE @SQLString varchar(250)
SET @SQLString = 'SELECT [' + @myVar + '] AS myOutput FROM [My Table]'
EXEC (@SQLString)
GO
I think to make UPDATE or INSERT SP is equal ....