>>>>Look at SQLEXEC() function.
>>>>
>>>>Also, it's bad practice to embed parameters into your sql query. It opens you up to SQL injection attacks.
>>>
>>>http://xkcd.com/327/
>>
>>I have always loved this XKCD.
>>
>>Technically he's wrong. He should say parameterize but sanitize fits in the space better :)
>>
>>http://select-into.blogspot.com/2011/01/little-bobby-tables.html
>
>Thanks for the link - that's the most concise explanation of strategies for migitation of SQL Injection I've ever seen.

I use parameters in my sql queries all the time, but I don't pass the sql query through the querystring from the internet....