title: Alternative to sp_executesql
body: <p>I've read that calling sp_executesql leaves your SQL Server vulnerable to hackers. Is there a realistic alternative that gives the same flexibility?
  (I'm of the opinion that the database should only be used to store the data but everywhere that I have worked wants business logic via the database.)</p>