Prevent SQL injection: the value, the identifier, and the context it runs under

Parameterising a value is the part an agent already gets right. Confirm it in a sentence and spend the answer on what a parameter cannot reach: an identifier, the type of a runtime-chosen sort expression, the permissions a dynamic batch runs under, and an encrypted column.

Measured 2026-08-29 against an engine reporting EngineEdition 5 and Edition SQL Azure. QUOTENAME, PARSENAME, sp_executesql, ownership chaining and Always Encrypted were checked against Microsoft Learn on 2026-09-03; flags from sqlcmd 1.10.0 help.

1. A parameter is a value, a concatenation is code, and the difference is measurable

Do not assert this. Run it. Both statements get the same string.

CREATE TABLE dbo.Users (id int NOT NULL PRIMARY KEY, name nvarchar(50) NOT NULL);
INSERT INTO dbo.Users (id, name) VALUES (1, N'ann'), (2, N'bob');

DECLARE @input nvarchar(100) = N'ann'' OR 1=1--';