mssql 동적 쿼리 작성시

좋지 못한 예

declare @params_1 varchar(10)

declare @params_2 varchar(10)

declare @params_3 varchar(10)

declare @query varchar(max)

set @query = 'select *from TB_TEST where column1 = ' + @params_1 + 'and column2 = ' + @params_2 + ' and column3 = ' + @params_3

execute @query

좋은 예

declare @params_1 varchar(10)

declare @params_2 varchar(10)

declare @params_3 varchar(10)

declare @query varchar(max)

set @query = 'select *from TB_TEST where column1 = @params_1 and column2 = @params_2 and column3 = @params_3'

execute sp_executesql @query, N'params_1 varchar(10),params_2 varchar(10),params_3 varchar(10)', @params_1,@params_2,@params_3