Sql injection will not take place with this code.I already tried.

declare @Inserttbl nvarchar(4000)

declare @TableName varchar(50)

declare @PId varchar(5)

declare @Text varchar(50)

declare @status varchar(5)

set @TableName ='sample'

set @Text = 'Helping hand;Delete table...

I already done insertion through parameter only...

Actually I have done like this.Let me still sql injection take place?

declare @Inserttbl nvarchar(4000)

declare @TableName varchar(50)

declare @PId int

declare @Text varchar(50)

declare @count int

declare @status int

set @TableName ='sample'

set @Text =...

Thanks @joeroshan for ur help.I have done like this.Here I just printed msg but in reality I will do insert.

declare @Inserttbl nvarchar(4000)

declare @TableName varchar(50)

declare @Text varchar(50)=null

declare @count int

set...

Thanks for reply.U mean to say like this

declare @Inserttbl nvarchar(4000)

declare @TableName varchar(50)

declare @Text varchar(50)=null

declare @count int

set @TableName...