Usage of sp_executequitedsql

example-181001.sql

-- Paramertizing a call to sp_executesql
Declare @sql nvarchar(max)
declare @par1 int, @par2 nvarchar(255), @par3 datetime

select @par1 = 5, @par2 = 'K%', @par3 = GETDATE()

-- Doubling double single quotes
select @sql = '
select * 
from openquery(LINKEDSERVER, ''
	select *
	from Employees
	where
		YearsInCompany > ' + str(@par1) + '
		and LastName like ''''' + @par2 + '''''
		and HireDate > ''''' + cast(@par3 as varchar(20)) + '''''
		limit 10'')'
print @sql
--exec sp_executesql @sql

-- Same but for sp_executequotedsql
select @sql = '
select * 
from openquery(LINKEDSERVER, `
	select *
	from Employees
	where
		YearsInCompany > ' + str(@par1) + '
		and LastName like "' + @par2 + '"
		and HireDate > "' + cast(@par3 as varchar(20)) + '"
		limit 10`)'
-- Omit the second parameter if you trust the code
exec sp_executequotedsql @sql, @debug = 1