But that would make me vulnerable to sql injection. Is it possible that I add the following to make sure the value being passed in isn't something malicious?create procedure [dbo].[sp_Sum]( @col nvarchar(50), @tbl nvarchar(50))as declare @iCntCol int, @iCntTbl int, @sql nvarchar(300) set @col = 'myCol' set @tbl = 'myTbl' select @iCntTbl = count(table_name) from information_schema.tables where table_name = @tbl if @iCntTbl = 1 begin select @iCntCol = count(column_name) from information_schema.columns where table_name = @tbl and column_name = @col if @iCntCol = 1 begin select @sql = 'select sum(' + @col + ') from ' + @tbl exec (@sql) end end