sql server - SQL injection with parameterised procedures -

need bit of sql injection issue:

the following version of parameterised stored procedure. excluding how called application, there anyway prevent @v_string being treated dynamic sql?

i think water tight - there's no execute or concatenated sql, still inserting semicolon allows additional data returned.

i know there multiple levels consider question on, want know if there simple solution missing here majority of injection fixes involve dynamic queries.

create table dbo.employee (empid int,empname varchar(60))   declare     @v_id int,     @v_string varchar(60) begin      set @v_string='test'''; waitfor delay '0:0:5' --       if  @v_id null      begin         set @v_id =            (select   empid                                      abc.employee                                     empname=@v_string);     end       print @v_id end  

is there anyway prevent @v_string being treated dynamic sql?

i not expect @v_string treated dynamic sql here since t-sql code has no execute or execute sp_executesql. value not executed, treated clause value not vulnerable sql injection.

if doesn't answer question, post full example demonstrates value being treated dynamic sql.