title: Alternatives to using dynamic sql
body: <p>I have a sp which takes input @featuretype. @featuretype will be equal to either "mobile", "login", or "index", and will correspond to a column in the db.</p>
  
  <p>In my sp I have:</p>
  
  <pre><code>EXEC(
      'select TOP 3 * from featuredtypes_v where'+' featuredtypes_v.'+@featuretype+'Page=1'+
      ' order by featuredtypes_v.priority desc'
      )
  </code></pre>
  
  <p>However, I've been told this opens up the db to a sql injection. My two questions are, why is this, and how else can I write this query in order to avoid this?</p>