I would build the rest of the request up to order, i.e.
@sql = 'SELECT id, name FROM myTable ORDER BY ' + @order
... and pass the name and direction of the column to proc. This method is safer, because not much can be transferred to the reservation clause to cause any harm.
To answer your question, yes, it is effective.
source
share