Not sure, if this great article was already referenced in this thread

The Curse and Blessings of Dynamic SQL

Thank you for posting the link.

 I agree with Manas. I use the Helper SQL myself. I had several sql injection attacks in the last few months to drop the database or change the data, but all of them were balked.

The main weak point for SQL injection attack is writing in-line SQL or building the statement in the Stored Procedure dynamically using string concatenations. To avaoid SQL injection attacks use Stored Procedures and pass the only values.

very simple and good post!

it will be helpful for many developers

As for me, it is very cut and dry with the matter - migration to LINQ to SQL clears up the problem: http://msdn.microsoft.com/en-us/library/bb386929.aspx