title: How to obtain a parsed SQL parameter in T-SQL
body: <p>I have a stored procedure that generates an SQL statement dynamically, and includes parameterized information that the client passes it.</p>
  
  <p>Normally I could use <code>sp_executesql</code> to pass the parameters directly through. However, I want to be able to pass this SQL statement to <em>another</em> general-purpose stored procedure that is used to return a particular page of data for a given query. So it's not trivial to pass arbitrary parameters to the end-of-the-line sproc.</p>
  
  <p>Is there a way I can have T-SQL just resolve the parameter and return a string, so I can create a complete, parameterless SQL string to pass to the final procedure? That is:</p>
  
  <pre><code>-- bad
  set @sql = 'select * from something where id=' + cast(@idParm as varchar(10))
  
  -- good - but can't pass @sql to something that doesn't know about its parms
  set @sql = 'select * from something where id=@idParm'
  exec sp_executesql @sql,N'@idParm int',@idParm
  
  -- what I want
  set @sql = 'select * from something where id = '+
      decode_parameter('@idParm int',@idParm)
  </code></pre>
  
  <p>I can't think of any reason this wouldn't be perfectly SQL injection safe, assuming there's an api in T-SQL to the parameter decoding mechanism. I mean, at the end of the day, a parameter is going to turn into some data that can be represented by a string in a query, so seems irrelevant if it happens here or at the end of the road. Is this possible?</p>