title: How to prevent SQL injection using a stored procedure while insert record?
body: <p>I am new to SQL Server, I am trying to insert records into table using a stored procedure as shown below.</p>
  
  <p>I want a suggestion that is using the below stored procedure. Also:</p>
  
  <ul>
  <li>can I prevent SQL injection?</li>
  <li>is it the right way? </li>
  </ul>
  
  <p>Correct me if I miss anything in below procedure which leads to SQL injection.</p>
  
  <pre><code>Create PROCEDURE [dbo].[spInsertParamTable]
     @CmpyCode nvarchar(50),
     @Code nvarchar(50),
     @DisplayCode nvarchar(50),
     @TotalDigit int,
     @Nos bigint,
     @IdentitY int OUTPUT
  AS
  BEGIN
     INSERT tblParamTable (CmpyCode, Code, DisplayCode, TotalDigit, Nos)
     VALUES (@CmpyCode, @Code, @DisplayCode, @TotalDigit, @Nos)
  END
  
  SELECT @Identity = SCOPE_IDENTITY();
  RETURN @Identity
  </code></pre>