3 don't use string concatenation to produce sql, you can use sp_executesql system stored prcedure to execute sql statement with parameters create procedure getdata @ID int, @frm varchar(250), @to varchar(250) as begin declare @sql nvarchar(max), @paramDefs nvarchar(max); set nocount on;