I created the procedure listed below:
CREATE procedure getdata
(
@ID int,
@frm varchar(250),
@to varchar(250)
)
AS
BEGIN
DECLARE @SQL nvarchar(5
don't use string concatenation to produce sql, you can use sp_executesql
system stored prcedure to execute sql statement with parameters
create procedure getdata @ID int, @frm varchar(250), @to varchar(250) as
begin
declare @sql nvarchar(max), @paramDefs nvarchar(max);
set nocount on;
set @sql = N'select EmpName, Address, Salary from Emp_Tb where @id is null or Emp_Id_Pk = @id';
set @paramDefs = N'@id int';
execute sp_executesql @sql, @paramDefs, @id = @ID;
end
see sp_executesql