Is this SP safe to SQL Injection? CREATE PROCEDURE [sp_Test] (
     @param nvarchar(Max)
) AS BEGIN

DECLARE @Output nvarchar(Max) = 
N’Select ‘ + @param

Select @output
Return

Intended Use
exec sp_test ‘5’
Returns “select 5”
Malicious Use
exec sp_test ‘5; drop database’
Returns(would be safe):
“select 5; drop database“
—-OR—-
Returns(not safe):
“select 5”
...but also actually dropping the database
MS SQL Server
All your stored procedure is doing is to put “select” in front of whatever is passed in. It doesn’t run anything.
But presumably you’re going to then ask something else to run whatever comes back, and that could be unsafe. If you’re wanting a very dynamic querying environment, then read what Erland Sommarskog has to say on the matter at http://www.sommarskog.se/dynamic_sql.html