title: SQL Server: Detect Non-Parameterized Queries
body: <p>I have a client which has had programming performed by past developers.  Their code has recently become suspect, and I'd like to know if they are using parameterized queries.  I was hoping I could detect non-parameterized requests through SQL Server, but I haven't found a way to do this.  I understand that not all queries need to be parameterized, since a query might be something like</p>
  
  <pre><code>select count(*) from Customers
  </code></pre>
  
  <p>But if SQL Server could tell me programmatically which queries have any string-constant inputs instead of parameter inputs, that would be great.
  By the way, logging all SQL queries and removing all lines with the @ symbol is close, but the below query would then be considered legitimate:</p>
  
  <pre><code>select * from Users where Username='user' and Password=@Password
  </code></pre>
  
  <p>So I really need SQL Server to read into the content of the command and determine if all inputs are parameterized.  Thank you.</p>