title: Like clause and sql injection
body: <p>I am having a doubt about this situation.</p>
  
  <p>I've a query like this within a Stored Procedure:</p>
  
  <pre><code>SELECT column1, column2
  FROM table1
  WHERE column1 like '%' + @column1 + '%'
  </code></pre>
  
  <p>My question is, this is vulnerable to SQL Injection? Do I need to change this to something like this: (?)</p>
  
  <pre><code>declare @column1Like nvarchar(200);
  
  @column1Like = '%' + @column1 + '%'
  
  SELECT column1, column2
  FROM table1
  WHERE column1 like @column1Like
  </code></pre>
  
  <p>Regards</p>