title: How to cleanse (prevent SQL injection) dynamic SQL in SQL Server?
body: <p>We have a ton of SQL Server stored procedures which rely on dynamic SQL.</p>
  
  <p>The parameters to the stored procedure are used in a dynamic SQL statement.</p>
  
  <p>We need a standard validation function inside these stored procedures to validate these parameters and prevent SQL injection.</p>
  
  <p>Assume we have these constraints:</p>
  
  <ol>
  <li><p>We can't rewrite the procedures to not use Dynamic SQL</p></li>
  <li><p>We can't use sp_OACreate etc., to use regular expressions for validation.</p></li>
  <li><p>We can't modify the application which calls the stored procedure to validate the parameters before they are passed to the stored procedure.</p></li>
  </ol>
  
  <p>Is there a set of characters we can filter out to ensure we are not susceptible to SQL injection?</p>