Thank Jeff for knowledge sharing. I really appreciate it.

Thanks to everyone who responded to this post.

Heera

Thanks Wagner, I did some research on sql injection and I understood it.

Thanks again to everyone for responding on this post.

Jeff,

I am new to SQL server, so I would appreciate if you could help me understand the SQL hacking concept. What is the purpose of quotename? How can I...

HI All,

Thanks a ton for the responses. I used below query by Scott. I removed the function quotename and it worked.

CREATE PROCEDURE sampleprocedure

@tablename AS varchar(4000),

...

Thank you for the quick reply.

I implemented the logic, but some how when I passed the table name it says invalid object name. The way I created is I created...