title: I'm confused About Parameterized SQL vs Stored Procedures Having Dynamic SQL i.e. are they the same?
body: <p>I have created the following procedure:</p>
  
  <pre><code> CREATE PROC dynamicColumnsWithCheck
   (
      @colName VARCHAR(MAX),
      @colCheck VARCHAR(MAX),
      @condition VARCHAR(MAX)
   )
  
   AS
  
   BEGIN
  
      DECLARE @sqlString NVARCHAR(MAX)
  
      SET @sqlString = N'SELECT ' + @colName + ' FROM Student WHERE ' + @colCheck + ' = ''' + @condition + ''''
  
      EXEC sp_executesql @sqlString
  
   END
  </code></pre>
  
  <p>It works perfect for me but my question is that, Is this parameterized SQL?
  or Is it the dangerous dynamic SQL?
  I'm confused about the security of this procedure after searching and learning a bit about SQL injection.</p>