See this simple stored procedure:

```
getUsers(@name, @age, @city) etc...

```

* if I pass the age just filter for the age
* if I pass the name and city filter for both parameters

I know that there is a way to build my SQL statement and then `EXEC(mySQL)`

but I want do something Like:

```
SELECT * into #tmp From Users WHERE active = 1
if(@name)
   SELECT * into #tmp From #tmp WHERE name = @name
if(@age)
   SELECT * into #tmp From #tmp WHERE age = @age
if(@city)
   SELECT * into #tmp From #tmp WHERE city = @city
SELECT * From #tmp -- result

```

This way we can avoid SQL injection.